feat(store): trust gate before every module install

One-click installs showed no trust signal at all (top security
finding of the usertest panel). Every install path — store card,
detail sheet, and the flow list's quick fix — now routes through
one confirmation dialog showing what the hub actually knows
before download: origin store, version, license, maturity, and
required services/capabilities, plus the sandbox model and an
honest note that per-entry signature status is not in the store
index yet (verification happens hub-side at install). Widget
tests cover content and confirm/cancel semantics.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_de.arb

@@ -1565,6 +1565,18 @@
   "aboutCopyTooltip": "Kopieren",
   "aboutCopiedToast": "In die Zwischenablage kopiert.",
   "sidebarSearchLabel": "Suchen & Befehle",
+  "installConfirmTitle": "„{name}\" installieren?",
+  "@installConfirmTitle": {"placeholders": {"name": {"type": "String"}}},
+  "installConfirmVersion": "Version",
+  "installConfirmSource": "Quelle",
+  "installConfirmSourceBundled": "Mitgelieferter Store-Index",
+  "installConfirmLicense": "Lizenz",
+  "installConfirmStatus": "Reifegrad",
+  "installConfirmNeedsServices": "Benötigte Dienste",
+  "installConfirmNeedsCapabilities": "Benötigte Fähigkeiten",
+  "installConfirmTrustTitle": "Vertrauen & Sicherheit",
+  "installConfirmTrustBody": "Das Modul läuft in einer Sandbox: Es darf nur auf die Netzwerk-Endpunkte, Dateien und Umgebungsvariablen zugreifen, die es selbst deklariert — der Hub setzt diese Liste durch. Die vollständige Berechtigungsliste sehen Sie nach der Installation in den Modul-Details.",
+  "installConfirmSignatureNote": "Signaturen prüft der Hub beim Installieren, sofern die Signaturpflicht im Sicherheitsprofil aktiv ist. Einen Signaturstatus vorab zeigt der Store-Index derzeit noch nicht an (Alpha).",
   "settingsSidebarPinnedTitle": "Navigation immer ausgeklappt",
   "settingsSidebarPinnedBody": "Zeigt die Beschriftungen der Seitenleiste dauerhaft an, statt sie nur beim Überfahren mit der Maus einzublenden.",
   "settingsCategoryAi": "System-KI",

lib/l10n/app_en.arb

@@ -1589,6 +1589,18 @@
   "aboutCopyTooltip": "Copy",
   "aboutCopiedToast": "Copied to the clipboard.",
   "sidebarSearchLabel": "Search & commands",
+  "installConfirmTitle": "Install \"{name}\"?",
+  "@installConfirmTitle": {"placeholders": {"name": {"type": "String"}}},
+  "installConfirmVersion": "Version",
+  "installConfirmSource": "Source",
+  "installConfirmSourceBundled": "Bundled store index",
+  "installConfirmLicense": "License",
+  "installConfirmStatus": "Maturity",
+  "installConfirmNeedsServices": "Required services",
+  "installConfirmNeedsCapabilities": "Required capabilities",
+  "installConfirmTrustTitle": "Trust & security",
+  "installConfirmTrustBody": "The module runs in a sandbox: it may only touch the network endpoints, files, and environment variables it declares itself — the hub enforces that list. The full permission list is visible in the module details after installation.",
+  "installConfirmSignatureNote": "The hub verifies signatures at install time whenever the security profile requires them. The store index does not yet show a per-entry signature status up front (alpha).",
   "settingsSidebarPinnedTitle": "Keep the navigation expanded",
   "settingsSidebarPinnedBody": "Shows the sidebar labels permanently instead of only while hovering with the mouse.",
   "settingsCategoryAi": "System AI",

lib/l10n/app_localizations.dart

@@ -4640,6 +4640,72 @@ abstract class AppLocalizations {
   /// **'Search & commands'**
   String get sidebarSearchLabel;
 
+  /// No description provided for @installConfirmTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Install \"{name}\"?'**
+  String installConfirmTitle(String name);
+
+  /// No description provided for @installConfirmVersion.
+  ///
+  /// In en, this message translates to:
+  /// **'Version'**
+  String get installConfirmVersion;
+
+  /// No description provided for @installConfirmSource.
+  ///
+  /// In en, this message translates to:
+  /// **'Source'**
+  String get installConfirmSource;
+
+  /// No description provided for @installConfirmSourceBundled.
+  ///
+  /// In en, this message translates to:
+  /// **'Bundled store index'**
+  String get installConfirmSourceBundled;
+
+  /// No description provided for @installConfirmLicense.
+  ///
+  /// In en, this message translates to:
+  /// **'License'**
+  String get installConfirmLicense;
+
+  /// No description provided for @installConfirmStatus.
+  ///
+  /// In en, this message translates to:
+  /// **'Maturity'**
+  String get installConfirmStatus;
+
+  /// No description provided for @installConfirmNeedsServices.
+  ///
+  /// In en, this message translates to:
+  /// **'Required services'**
+  String get installConfirmNeedsServices;
+
+  /// No description provided for @installConfirmNeedsCapabilities.
+  ///
+  /// In en, this message translates to:
+  /// **'Required capabilities'**
+  String get installConfirmNeedsCapabilities;
+
+  /// No description provided for @installConfirmTrustTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Trust & security'**
+  String get installConfirmTrustTitle;
+
+  /// No description provided for @installConfirmTrustBody.
+  ///
+  /// In en, this message translates to:
+  /// **'The module runs in a sandbox: it may only touch the network endpoints, files, and environment variables it declares itself — the hub enforces that list. The full permission list is visible in the module details after installation.'**
+  String get installConfirmTrustBody;
+
+  /// No description provided for @installConfirmSignatureNote.
+  ///
+  /// In en, this message translates to:
+  /// **'The hub verifies signatures at install time whenever the security profile requires them. The store index does not yet show a per-entry signature status up front (alpha).'**
+  String get installConfirmSignatureNote;
+
   /// No description provided for @settingsSidebarPinnedTitle.
   ///
   /// In en, this message translates to:

lib/l10n/app_localizations_de.dart

@@ -2715,6 +2715,43 @@ class AppLocalizationsDe extends AppLocalizations {
   @override
   String get sidebarSearchLabel => 'Suchen & Befehle';
 
+  @override
+  String installConfirmTitle(String name) {
+    return '„$name\" installieren?';
+  }
+
+  @override
+  String get installConfirmVersion => 'Version';
+
+  @override
+  String get installConfirmSource => 'Quelle';
+
+  @override
+  String get installConfirmSourceBundled => 'Mitgelieferter Store-Index';
+
+  @override
+  String get installConfirmLicense => 'Lizenz';
+
+  @override
+  String get installConfirmStatus => 'Reifegrad';
+
+  @override
+  String get installConfirmNeedsServices => 'Benötigte Dienste';
+
+  @override
+  String get installConfirmNeedsCapabilities => 'Benötigte Fähigkeiten';
+
+  @override
+  String get installConfirmTrustTitle => 'Vertrauen & Sicherheit';
+
+  @override
+  String get installConfirmTrustBody =>
+      'Das Modul läuft in einer Sandbox: Es darf nur auf die Netzwerk-Endpunkte, Dateien und Umgebungsvariablen zugreifen, die es selbst deklariert — der Hub setzt diese Liste durch. Die vollständige Berechtigungsliste sehen Sie nach der Installation in den Modul-Details.';
+
+  @override
+  String get installConfirmSignatureNote =>
+      'Signaturen prüft der Hub beim Installieren, sofern die Signaturpflicht im Sicherheitsprofil aktiv ist. Einen Signaturstatus vorab zeigt der Store-Index derzeit noch nicht an (Alpha).';
+
   @override
   String get settingsSidebarPinnedTitle => 'Navigation immer ausgeklappt';
 

lib/l10n/app_localizations_en.dart

@@ -2717,6 +2717,43 @@ class AppLocalizationsEn extends AppLocalizations {
   @override
   String get sidebarSearchLabel => 'Search & commands';
 
+  @override
+  String installConfirmTitle(String name) {
+    return 'Install \"$name\"?';
+  }
+
+  @override
+  String get installConfirmVersion => 'Version';
+
+  @override
+  String get installConfirmSource => 'Source';
+
+  @override
+  String get installConfirmSourceBundled => 'Bundled store index';
+
+  @override
+  String get installConfirmLicense => 'License';
+
+  @override
+  String get installConfirmStatus => 'Maturity';
+
+  @override
+  String get installConfirmNeedsServices => 'Required services';
+
+  @override
+  String get installConfirmNeedsCapabilities => 'Required capabilities';
+
+  @override
+  String get installConfirmTrustTitle => 'Trust & security';
+
+  @override
+  String get installConfirmTrustBody =>
+      'The module runs in a sandbox: it may only touch the network endpoints, files, and environment variables it declares itself — the hub enforces that list. The full permission list is visible in the module details after installation.';
+
+  @override
+  String get installConfirmSignatureNote =>
+      'The hub verifies signatures at install time whenever the security profile requires them. The store index does not yet show a per-entry signature status up front (alpha).';
+
   @override
   String get settingsSidebarPinnedTitle => 'Keep the navigation expanded';