feat(studio): localise Settings sidebar + add inline help docs + Approvals doc

Three operator-UX gaps closed:

  - Settings dialog's six-category sidebar (General / Appearance /
    System AI / Integrations / Security / Maintenance) was
    hardcoded English; now flows through AppLocalizations
    ("Allgemein" / "Darstellung" / "System-KI" / "Integrationen" /
    "Sicherheit" / "Wartung"). Same for the per-panel title +
    description.
  - Per-channel daemon-action labels ('enable autostart' /
    'disable autostart' / 'daemon restart' etc.) and the
    OK / Failed result line in the toast also moved to l10n,
    so the system-action feedback reads as one language.
  - New 'Approvals' doc bundle (en + de) under assets/docs/,
    registered as a fifth doc card on Welcome plus exposed via
    the new public  helper. The
    Approvals, Audit and Doctor app-bars grow a Help icon button
    next to Refresh that opens the matching doc in the existing
    bottom-sheet reader — no extra screen, no learning curve.

Studio bumped to 0.67.0; editor path-override pulls in 0.20.1
(flow-list row polish).

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_de.arb

@@ -27,6 +27,9 @@
   "welcomeDocAuditBlurb": "Wie die Hash-Kette funktioniert und warum WORM-1 für KRITIS reicht.",
   "welcomeDocFlowsTitle": "Flow-Komposition",
   "welcomeDocFlowsBlurb": "YAML-Grundlagen, Templating-Referenz, das Extract→Summarize-Beispiel.",
+  "welcomeDocApprovalsTitle": "Freigaben",
+  "welcomeDocApprovalsBlurb": "Human-in-the-Loop-Checkpoints — wann nutzen, wie das Audit-Log sie protokolliert.",
+  "helpTooltip": "Hilfe",
   "welcomeDocClose": "Schließen",
   "welcomeDocFailedToLoad": "Doku konnte nicht geladen werden: {error}",
   "@welcomeDocFailedToLoad": {
@@ -1449,6 +1452,41 @@
     }
   },
   "doctorPathStudioErrors": "Studio-Fehler",
+  "settingsCategoryGeneral": "Allgemein",
+  "settingsCategoryAppearance": "Darstellung",
+  "settingsCategoryAi": "System-KI",
+  "settingsCategoryIntegrations": "Integrationen",
+  "settingsCategorySecurity": "Sicherheit",
+  "settingsCategoryMaintenance": "Wartung",
+  "settingsAiPanelTitle": "System-KI",
+  "settingsAiPanelBody": "Operator-verwalteter LLM-Endpunkt, den Studio für die KI-Helfer nutzt (System-KI-Edit, Install-Vorschläge, Doctor-Zusammenfassung). Kein Flow ruft das jemals auf; Module sprechen mit ihrem eigenen LLM.",
+  "settingsIntegrationsPanelTitle": "Integrationen",
+  "settingsIntegrationsPanelBody": "Externe Tool-Server, deren Capabilities der Hub föderiert. MCP-Server bieten Tool-Endpunkte; n8n-Endpunkte stellen gehostete Workflows bereit.",
+  "settingsSecurityPanelTitle": "Sicherheit & Zugangsdaten",
+  "settingsSecurityPanelBody": "Tokens, die der Hub für dich verwahrt. Liegen in ~/.fai/ mit Modus 0600; werden nie als Telemetrie versendet.",
+  "settingsMaintenancePanelTitle": "Wartung",
+  "settingsMaintenancePanelBody": "Destruktive Aktionen, abgesichert durch explizite Bestätigungs-Dialoge. Nutzen z.B. beim Re-Pilot-Testen oder Debuggen.",
+  "tooltipMoveUp": "Nach oben",
+  "tooltipMoveDown": "Nach unten",
+  "tooltipRemove": "Entfernen",
+  "daemonActionEnableAutostart": "Autostart aktivieren",
+  "daemonActionDisableAutostart": "Autostart deaktivieren",
+  "daemonActionRestart": "Daemon neu starten",
+  "daemonActionStart": "Daemon starten",
+  "daemonActionStop": "Daemon stoppen",
+  "daemonActionStatus": "Daemon-Status",
+  "daemonActionResultOk": "OK · {label}",
+  "@daemonActionResultOk": {
+    "placeholders": {
+      "label": {"type": "String"}
+    }
+  },
+  "daemonActionResultFailed": "Fehlgeschlagen · {label}",
+  "@daemonActionResultFailed": {
+    "placeholders": {
+      "label": {"type": "String"}
+    }
+  },
   "addSourceTitle": "Modul-Quelle hinzufügen",
   "addSourceIntro": "`{capability}` ist nicht im öffentlichen Store. Zeig dem Hub eine `.fai`-Bundle-URL oder einen lokalen Bundle-Pfad — der Hub lädt es herunter, prüft (sha256 + Signatur) und installiert.",
   "@addSourceIntro": {

lib/l10n/app_en.arb

@@ -30,6 +30,9 @@
   "welcomeDocAuditBlurb": "How the hash chain works and why WORM-1 is enough for KRITIS.",
   "welcomeDocFlowsTitle": "Flow composition",
   "welcomeDocFlowsBlurb": "YAML basics, templating reference, the extract→summarize example.",
+  "welcomeDocApprovalsTitle": "Approvals",
+  "welcomeDocApprovalsBlurb": "Human-in-the-loop checkpoints — when to use them, how the audit log records them.",
+  "helpTooltip": "Help",
   "welcomeDocClose": "Close",
   "welcomeDocFailedToLoad": "Could not load documentation: {error}",
   "@welcomeDocFailedToLoad": {
@@ -1452,6 +1455,41 @@
     }
   },
   "doctorPathStudioErrors": "Studio errors",
+  "settingsCategoryGeneral": "General",
+  "settingsCategoryAppearance": "Appearance",
+  "settingsCategoryAi": "System AI",
+  "settingsCategoryIntegrations": "Integrations",
+  "settingsCategorySecurity": "Security",
+  "settingsCategoryMaintenance": "Maintenance",
+  "settingsAiPanelTitle": "System AI",
+  "settingsAiPanelBody": "Operator-managed LLM endpoint used by Studio for the AI helpers (system-ai-edit, install-suggest, doctor-summary). No flow ever calls this; modules speak to their own LLM.",
+  "settingsIntegrationsPanelTitle": "Integrations",
+  "settingsIntegrationsPanelBody": "External tool servers the hub federates capabilities from. MCP servers expose tool-shaped endpoints; n8n endpoints expose hosted workflows.",
+  "settingsSecurityPanelTitle": "Security & credentials",
+  "settingsSecurityPanelBody": "Tokens the hub holds on the operator's behalf. Stored in ~/.fai/ with mode 0600; never sent in telemetry.",
+  "settingsMaintenancePanelTitle": "Maintenance",
+  "settingsMaintenancePanelBody": "Destructive operations gated behind explicit confirm dialogs. Use when re-pilot-testing or debugging.",
+  "tooltipMoveUp": "Move up",
+  "tooltipMoveDown": "Move down",
+  "tooltipRemove": "Remove",
+  "daemonActionEnableAutostart": "enable autostart",
+  "daemonActionDisableAutostart": "disable autostart",
+  "daemonActionRestart": "daemon restart",
+  "daemonActionStart": "daemon start",
+  "daemonActionStop": "daemon stop",
+  "daemonActionStatus": "daemon status",
+  "daemonActionResultOk": "OK · {label}",
+  "@daemonActionResultOk": {
+    "placeholders": {
+      "label": {"type": "String"}
+    }
+  },
+  "daemonActionResultFailed": "Failed · {label}",
+  "@daemonActionResultFailed": {
+    "placeholders": {
+      "label": {"type": "String"}
+    }
+  },
   "addSourceTitle": "Add module source",
   "addSourceIntro": "`{capability}` is not in the public store. Point the hub at a `.fai` bundle URL or a local bundle path; the hub downloads, verifies (sha256 + signature) and installs it.",
   "@addSourceIntro": {

lib/l10n/app_localizations.dart

@@ -260,6 +260,24 @@ abstract class AppLocalizations {
   /// **'YAML basics, templating reference, the extract→summarize example.'**
   String get welcomeDocFlowsBlurb;
 
+  /// No description provided for @welcomeDocApprovalsTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Approvals'**
+  String get welcomeDocApprovalsTitle;
+
+  /// No description provided for @welcomeDocApprovalsBlurb.
+  ///
+  /// In en, this message translates to:
+  /// **'Human-in-the-loop checkpoints — when to use them, how the audit log records them.'**
+  String get welcomeDocApprovalsBlurb;
+
+  /// No description provided for @helpTooltip.
+  ///
+  /// In en, this message translates to:
+  /// **'Help'**
+  String get helpTooltip;
+
   /// No description provided for @welcomeDocClose.
   ///
   /// In en, this message translates to:
@@ -3968,6 +3986,156 @@ abstract class AppLocalizations {
   /// **'Studio errors'**
   String get doctorPathStudioErrors;
 
+  /// No description provided for @settingsCategoryGeneral.
+  ///
+  /// In en, this message translates to:
+  /// **'General'**
+  String get settingsCategoryGeneral;
+
+  /// No description provided for @settingsCategoryAppearance.
+  ///
+  /// In en, this message translates to:
+  /// **'Appearance'**
+  String get settingsCategoryAppearance;
+
+  /// No description provided for @settingsCategoryAi.
+  ///
+  /// In en, this message translates to:
+  /// **'System AI'**
+  String get settingsCategoryAi;
+
+  /// No description provided for @settingsCategoryIntegrations.
+  ///
+  /// In en, this message translates to:
+  /// **'Integrations'**
+  String get settingsCategoryIntegrations;
+
+  /// No description provided for @settingsCategorySecurity.
+  ///
+  /// In en, this message translates to:
+  /// **'Security'**
+  String get settingsCategorySecurity;
+
+  /// No description provided for @settingsCategoryMaintenance.
+  ///
+  /// In en, this message translates to:
+  /// **'Maintenance'**
+  String get settingsCategoryMaintenance;
+
+  /// No description provided for @settingsAiPanelTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'System AI'**
+  String get settingsAiPanelTitle;
+
+  /// No description provided for @settingsAiPanelBody.
+  ///
+  /// In en, this message translates to:
+  /// **'Operator-managed LLM endpoint used by Studio for the AI helpers (system-ai-edit, install-suggest, doctor-summary). No flow ever calls this; modules speak to their own LLM.'**
+  String get settingsAiPanelBody;
+
+  /// No description provided for @settingsIntegrationsPanelTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Integrations'**
+  String get settingsIntegrationsPanelTitle;
+
+  /// No description provided for @settingsIntegrationsPanelBody.
+  ///
+  /// In en, this message translates to:
+  /// **'External tool servers the hub federates capabilities from. MCP servers expose tool-shaped endpoints; n8n endpoints expose hosted workflows.'**
+  String get settingsIntegrationsPanelBody;
+
+  /// No description provided for @settingsSecurityPanelTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Security & credentials'**
+  String get settingsSecurityPanelTitle;
+
+  /// No description provided for @settingsSecurityPanelBody.
+  ///
+  /// In en, this message translates to:
+  /// **'Tokens the hub holds on the operator\'s behalf. Stored in ~/.fai/ with mode 0600; never sent in telemetry.'**
+  String get settingsSecurityPanelBody;
+
+  /// No description provided for @settingsMaintenancePanelTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Maintenance'**
+  String get settingsMaintenancePanelTitle;
+
+  /// No description provided for @settingsMaintenancePanelBody.
+  ///
+  /// In en, this message translates to:
+  /// **'Destructive operations gated behind explicit confirm dialogs. Use when re-pilot-testing or debugging.'**
+  String get settingsMaintenancePanelBody;
+
+  /// No description provided for @tooltipMoveUp.
+  ///
+  /// In en, this message translates to:
+  /// **'Move up'**
+  String get tooltipMoveUp;
+
+  /// No description provided for @tooltipMoveDown.
+  ///
+  /// In en, this message translates to:
+  /// **'Move down'**
+  String get tooltipMoveDown;
+
+  /// No description provided for @tooltipRemove.
+  ///
+  /// In en, this message translates to:
+  /// **'Remove'**
+  String get tooltipRemove;
+
+  /// No description provided for @daemonActionEnableAutostart.
+  ///
+  /// In en, this message translates to:
+  /// **'enable autostart'**
+  String get daemonActionEnableAutostart;
+
+  /// No description provided for @daemonActionDisableAutostart.
+  ///
+  /// In en, this message translates to:
+  /// **'disable autostart'**
+  String get daemonActionDisableAutostart;
+
+  /// No description provided for @daemonActionRestart.
+  ///
+  /// In en, this message translates to:
+  /// **'daemon restart'**
+  String get daemonActionRestart;
+
+  /// No description provided for @daemonActionStart.
+  ///
+  /// In en, this message translates to:
+  /// **'daemon start'**
+  String get daemonActionStart;
+
+  /// No description provided for @daemonActionStop.
+  ///
+  /// In en, this message translates to:
+  /// **'daemon stop'**
+  String get daemonActionStop;
+
+  /// No description provided for @daemonActionStatus.
+  ///
+  /// In en, this message translates to:
+  /// **'daemon status'**
+  String get daemonActionStatus;
+
+  /// No description provided for @daemonActionResultOk.
+  ///
+  /// In en, this message translates to:
+  /// **'OK · {label}'**
+  String daemonActionResultOk(String label);
+
+  /// No description provided for @daemonActionResultFailed.
+  ///
+  /// In en, this message translates to:
+  /// **'Failed · {label}'**
+  String daemonActionResultFailed(String label);
+
   /// No description provided for @addSourceTitle.
   ///
   /// In en, this message translates to:

lib/l10n/app_localizations_de.dart

@@ -101,6 +101,16 @@ class AppLocalizationsDe extends AppLocalizations {
   String get welcomeDocFlowsBlurb =>
       'YAML-Grundlagen, Templating-Referenz, das Extract→Summarize-Beispiel.';
 
+  @override
+  String get welcomeDocApprovalsTitle => 'Freigaben';
+
+  @override
+  String get welcomeDocApprovalsBlurb =>
+      'Human-in-the-Loop-Checkpoints — wann nutzen, wie das Audit-Log sie protokolliert.';
+
+  @override
+  String get helpTooltip => 'Hilfe';
+
   @override
   String get welcomeDocClose => 'Schließen';
 
@@ -2323,6 +2333,89 @@ class AppLocalizationsDe extends AppLocalizations {
   @override
   String get doctorPathStudioErrors => 'Studio-Fehler';
 
+  @override
+  String get settingsCategoryGeneral => 'Allgemein';
+
+  @override
+  String get settingsCategoryAppearance => 'Darstellung';
+
+  @override
+  String get settingsCategoryAi => 'System-KI';
+
+  @override
+  String get settingsCategoryIntegrations => 'Integrationen';
+
+  @override
+  String get settingsCategorySecurity => 'Sicherheit';
+
+  @override
+  String get settingsCategoryMaintenance => 'Wartung';
+
+  @override
+  String get settingsAiPanelTitle => 'System-KI';
+
+  @override
+  String get settingsAiPanelBody =>
+      'Operator-verwalteter LLM-Endpunkt, den Studio für die KI-Helfer nutzt (System-KI-Edit, Install-Vorschläge, Doctor-Zusammenfassung). Kein Flow ruft das jemals auf; Module sprechen mit ihrem eigenen LLM.';
+
+  @override
+  String get settingsIntegrationsPanelTitle => 'Integrationen';
+
+  @override
+  String get settingsIntegrationsPanelBody =>
+      'Externe Tool-Server, deren Capabilities der Hub föderiert. MCP-Server bieten Tool-Endpunkte; n8n-Endpunkte stellen gehostete Workflows bereit.';
+
+  @override
+  String get settingsSecurityPanelTitle => 'Sicherheit & Zugangsdaten';
+
+  @override
+  String get settingsSecurityPanelBody =>
+      'Tokens, die der Hub für dich verwahrt. Liegen in ~/.fai/ mit Modus 0600; werden nie als Telemetrie versendet.';
+
+  @override
+  String get settingsMaintenancePanelTitle => 'Wartung';
+
+  @override
+  String get settingsMaintenancePanelBody =>
+      'Destruktive Aktionen, abgesichert durch explizite Bestätigungs-Dialoge. Nutzen z.B. beim Re-Pilot-Testen oder Debuggen.';
+
+  @override
+  String get tooltipMoveUp => 'Nach oben';
+
+  @override
+  String get tooltipMoveDown => 'Nach unten';
+
+  @override
+  String get tooltipRemove => 'Entfernen';
+
+  @override
+  String get daemonActionEnableAutostart => 'Autostart aktivieren';
+
+  @override
+  String get daemonActionDisableAutostart => 'Autostart deaktivieren';
+
+  @override
+  String get daemonActionRestart => 'Daemon neu starten';
+
+  @override
+  String get daemonActionStart => 'Daemon starten';
+
+  @override
+  String get daemonActionStop => 'Daemon stoppen';
+
+  @override
+  String get daemonActionStatus => 'Daemon-Status';
+
+  @override
+  String daemonActionResultOk(String label) {
+    return 'OK · $label';
+  }
+
+  @override
+  String daemonActionResultFailed(String label) {
+    return 'Fehlgeschlagen · $label';
+  }
+
   @override
   String get addSourceTitle => 'Modul-Quelle hinzufügen';
 

lib/l10n/app_localizations_en.dart

@@ -101,6 +101,16 @@ class AppLocalizationsEn extends AppLocalizations {
   String get welcomeDocFlowsBlurb =>
       'YAML basics, templating reference, the extract→summarize example.';
 
+  @override
+  String get welcomeDocApprovalsTitle => 'Approvals';
+
+  @override
+  String get welcomeDocApprovalsBlurb =>
+      'Human-in-the-loop checkpoints — when to use them, how the audit log records them.';
+
+  @override
+  String get helpTooltip => 'Help';
+
   @override
   String get welcomeDocClose => 'Close';
 
@@ -2328,6 +2338,89 @@ class AppLocalizationsEn extends AppLocalizations {
   @override
   String get doctorPathStudioErrors => 'Studio errors';
 
+  @override
+  String get settingsCategoryGeneral => 'General';
+
+  @override
+  String get settingsCategoryAppearance => 'Appearance';
+
+  @override
+  String get settingsCategoryAi => 'System AI';
+
+  @override
+  String get settingsCategoryIntegrations => 'Integrations';
+
+  @override
+  String get settingsCategorySecurity => 'Security';
+
+  @override
+  String get settingsCategoryMaintenance => 'Maintenance';
+
+  @override
+  String get settingsAiPanelTitle => 'System AI';
+
+  @override
+  String get settingsAiPanelBody =>
+      'Operator-managed LLM endpoint used by Studio for the AI helpers (system-ai-edit, install-suggest, doctor-summary). No flow ever calls this; modules speak to their own LLM.';
+
+  @override
+  String get settingsIntegrationsPanelTitle => 'Integrations';
+
+  @override
+  String get settingsIntegrationsPanelBody =>
+      'External tool servers the hub federates capabilities from. MCP servers expose tool-shaped endpoints; n8n endpoints expose hosted workflows.';
+
+  @override
+  String get settingsSecurityPanelTitle => 'Security & credentials';
+
+  @override
+  String get settingsSecurityPanelBody =>
+      'Tokens the hub holds on the operator\'s behalf. Stored in ~/.fai/ with mode 0600; never sent in telemetry.';
+
+  @override
+  String get settingsMaintenancePanelTitle => 'Maintenance';
+
+  @override
+  String get settingsMaintenancePanelBody =>
+      'Destructive operations gated behind explicit confirm dialogs. Use when re-pilot-testing or debugging.';
+
+  @override
+  String get tooltipMoveUp => 'Move up';
+
+  @override
+  String get tooltipMoveDown => 'Move down';
+
+  @override
+  String get tooltipRemove => 'Remove';
+
+  @override
+  String get daemonActionEnableAutostart => 'enable autostart';
+
+  @override
+  String get daemonActionDisableAutostart => 'disable autostart';
+
+  @override
+  String get daemonActionRestart => 'daemon restart';
+
+  @override
+  String get daemonActionStart => 'daemon start';
+
+  @override
+  String get daemonActionStop => 'daemon stop';
+
+  @override
+  String get daemonActionStatus => 'daemon status';
+
+  @override
+  String daemonActionResultOk(String label) {
+    return 'OK · $label';
+  }
+
+  @override
+  String daemonActionResultFailed(String label) {
+    return 'Failed · $label';
+  }
+
   @override
   String get addSourceTitle => 'Add module source';