feat(store): trust gate before every module install

One-click installs showed no trust signal at all (top security
finding of the usertest panel). Every install path — store card,
detail sheet, and the flow list's quick fix — now routes through
one confirmation dialog showing what the hub actually knows
before download: origin store, version, license, maturity, and
required services/capabilities, plus the sandbox model and an
honest note that per-entry signature status is not in the store
index yet (verification happens hub-side at install). Widget
tests cover content and confirm/cancel semantics.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/pages/flows.dart

@@ -19,6 +19,7 @@ import '../data/flow_run_driver.dart';
 import '../data/hub.dart';
 import '../data/workspace.dart';
 import '../l10n/app_localizations.dart';
+import '../widgets/chain_install_confirm.dart';
 
 class FlowsPage extends StatefulWidget {
   /// Pre-load this flow when the editor first builds. Studio
@@ -114,6 +115,11 @@ class _FlowsPageState extends State<FlowsPage> {
     // entry for 'debug.echo@^0'"). Strip it — same as the Store page.
     final at = capability.indexOf('@');
     final bare = at < 0 ? capability : capability.substring(0, at);
+    // The quick-fix install goes through the same trust dialog as
+    // the Store page — no quieter direct path.
+    final confirmed =
+        await ChainInstallConfirmDialog.showForCapability(context, bare);
+    if (!confirmed) return null;
     return _runInstall(source: bare);
   }