feat(store): trust gate before every module install

One-click installs showed no trust signal at all (top security
finding of the usertest panel). Every install path — store card,
detail sheet, and the flow list's quick fix — now routes through
one confirmation dialog showing what the hub actually knows
before download: origin store, version, license, maturity, and
required services/capabilities, plus the sandbox model and an
honest note that per-entry signature status is not in the store
index yet (verification happens hub-side at install). Widget
tests cover content and confirm/cancel semantics.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_localizations_en.dart

@@ -2717,6 +2717,43 @@ class AppLocalizationsEn extends AppLocalizations {
   @override
   String get sidebarSearchLabel => 'Search & commands';
 
+  @override
+  String installConfirmTitle(String name) {
+    return 'Install \"$name\"?';
+  }
+
+  @override
+  String get installConfirmVersion => 'Version';
+
+  @override
+  String get installConfirmSource => 'Source';
+
+  @override
+  String get installConfirmSourceBundled => 'Bundled store index';
+
+  @override
+  String get installConfirmLicense => 'License';
+
+  @override
+  String get installConfirmStatus => 'Maturity';
+
+  @override
+  String get installConfirmNeedsServices => 'Required services';
+
+  @override
+  String get installConfirmNeedsCapabilities => 'Required capabilities';
+
+  @override
+  String get installConfirmTrustTitle => 'Trust & security';
+
+  @override
+  String get installConfirmTrustBody =>
+      'The module runs in a sandbox: it may only touch the network endpoints, files, and environment variables it declares itself — the hub enforces that list. The full permission list is visible in the module details after installation.';
+
+  @override
+  String get installConfirmSignatureNote =>
+      'The hub verifies signatures at install time whenever the security profile requires them. The store index does not yet show a per-entry signature status up front (alpha).';
+
   @override
   String get settingsSidebarPinnedTitle => 'Keep the navigation expanded';