feat(store): trust gate before every module install

One-click installs showed no trust signal at all (top security
finding of the usertest panel). Every install path — store card,
detail sheet, and the flow list's quick fix — now routes through
one confirmation dialog showing what the hub actually knows
before download: origin store, version, license, maturity, and
required services/capabilities, plus the sandbox model and an
honest note that per-entry signature status is not in the store
index yet (verification happens hub-side at install). Widget
tests cover content and confirm/cancel semantics.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_en.arb

@@ -1589,6 +1589,18 @@
   "aboutCopyTooltip": "Copy",
   "aboutCopiedToast": "Copied to the clipboard.",
   "sidebarSearchLabel": "Search & commands",
+  "installConfirmTitle": "Install \"{name}\"?",
+  "@installConfirmTitle": {"placeholders": {"name": {"type": "String"}}},
+  "installConfirmVersion": "Version",
+  "installConfirmSource": "Source",
+  "installConfirmSourceBundled": "Bundled store index",
+  "installConfirmLicense": "License",
+  "installConfirmStatus": "Maturity",
+  "installConfirmNeedsServices": "Required services",
+  "installConfirmNeedsCapabilities": "Required capabilities",
+  "installConfirmTrustTitle": "Trust & security",
+  "installConfirmTrustBody": "The module runs in a sandbox: it may only touch the network endpoints, files, and environment variables it declares itself — the hub enforces that list. The full permission list is visible in the module details after installation.",
+  "installConfirmSignatureNote": "The hub verifies signatures at install time whenever the security profile requires them. The store index does not yet show a per-entry signature status up front (alpha).",
   "settingsSidebarPinnedTitle": "Keep the navigation expanded",
   "settingsSidebarPinnedBody": "Shows the sidebar labels permanently instead of only while hovering with the mouse.",
   "settingsCategoryAi": "System AI",