feat(studio): Welcome page — Phase A scaffolding (v0.37.0)

First slice of the new sidebar destination outlined in
docs/landing-page-design.md. Static content only — embedded
docs (Phase B) and the live getting-started checklist
(Phase C) follow.

Phase A:

- New `WelcomePage` at `lib/pages/welcome.dart`, registered
  as sidebar slot 0 above Doctor. Default selectedIndex stays
  0, so a fresh launch lands on Welcome.
- Hero card: gradient backdrop matching the Today-Hero in the
  store, F∆I Platform headline, subtitle taken from CLAUDE.md
  ("deterministic workflow engine for AI-assisted document
  processing in regulated environments").
- Three-pillar row "Hub / Module / Flow" — operator-readable
  prose, not architecture-doc dense. Stacks to a column under
  640 dp window width so card text never gets cropped.
- Trust-posture deck — "Sandbox by default", "Tamper-evident
  audit log", "Air-gap ready". Same content that used to
  rotate as carousel slides in the store; reading them as a
  single deck with full prose works better than rotating
  through fragments.
- AppBar follows the same `titleSpacing: FaiSpace.xl`
  alignment as the Store so the title sits flush with the
  body padding.
- 13 new ARB keys for the page content (EN + DE).

Smoke test now expects "Welcome" in the navigation rail; the
existing `Doctor / Store / Flows / Audit / Approvals`
expectations stay unchanged.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_localizations.dart

@@ -104,6 +104,108 @@ abstract class AppLocalizations {
   /// **'F∆I Studio'**
   String get appTitle;
 
+  /// No description provided for @navWelcome.
+  ///
+  /// In en, this message translates to:
+  /// **'Welcome'**
+  String get navWelcome;
+
+  /// No description provided for @welcomeHeroTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'F∆I Platform'**
+  String get welcomeHeroTitle;
+
+  /// No description provided for @welcomeHeroSubtitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Deterministic workflow engine for AI-assisted document processing in regulated environments.'**
+  String get welcomeHeroSubtitle;
+
+  /// No description provided for @welcomePillarsHeader.
+  ///
+  /// In en, this message translates to:
+  /// **'HOW IT FITS TOGETHER'**
+  String get welcomePillarsHeader;
+
+  /// No description provided for @welcomePillarHubTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Hub'**
+  String get welcomePillarHubTitle;
+
+  /// No description provided for @welcomePillarHubBody.
+  ///
+  /// In en, this message translates to:
+  /// **'One Rust binary that loads modules and runs flows. SQLite for state. No Docker, no message broker, no background services to babysit.'**
+  String get welcomePillarHubBody;
+
+  /// No description provided for @welcomePillarModuleTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Module'**
+  String get welcomePillarModuleTitle;
+
+  /// No description provided for @welcomePillarModuleBody.
+  ///
+  /// In en, this message translates to:
+  /// **'A small WebAssembly component that does one thing. Declares the network endpoints, files, and environment variables it touches; the hub enforces the list.'**
+  String get welcomePillarModuleBody;
+
+  /// No description provided for @welcomePillarFlowTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Flow'**
+  String get welcomePillarFlowTitle;
+
+  /// No description provided for @welcomePillarFlowBody.
+  ///
+  /// In en, this message translates to:
+  /// **'A YAML file that chains modules together. Inputs go in, modules run in declared order, outputs come out — every step recorded in a hash-chained audit log.'**
+  String get welcomePillarFlowBody;
+
+  /// No description provided for @welcomeTrustHeader.
+  ///
+  /// In en, this message translates to:
+  /// **'TRUST POSTURE'**
+  String get welcomeTrustHeader;
+
+  /// No description provided for @welcomeTrustSandboxTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Sandbox by default'**
+  String get welcomeTrustSandboxTitle;
+
+  /// No description provided for @welcomeTrustSandboxBody.
+  ///
+  /// In en, this message translates to:
+  /// **'Every module ships with an explicit permission list — network endpoints, files, environment variables. The hub enforces it; nothing reaches outside the sandbox without operator approval.'**
+  String get welcomeTrustSandboxBody;
+
+  /// No description provided for @welcomeTrustAuditTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Tamper-evident audit log'**
+  String get welcomeTrustAuditTitle;
+
+  /// No description provided for @welcomeTrustAuditBody.
+  ///
+  /// In en, this message translates to:
+  /// **'Flow runs, install / uninstall actions, approval decisions — all of them write into a hash-chained audit log. The Doctor page verifies the chain end-to-end on every load.'**
+  String get welcomeTrustAuditBody;
+
+  /// No description provided for @welcomeTrustAirgapTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Air-gap ready'**
+  String get welcomeTrustAirgapTitle;
+
+  /// No description provided for @welcomeTrustAirgapBody.
+  ///
+  /// In en, this message translates to:
+  /// **'The whole hub fits in a single binary that runs on Linux, macOS and Windows. Once a module is installed, the flow it powers runs without further network access — perfect for regulated environments.'**
+  String get welcomeTrustAirgapBody;
+
   /// No description provided for @navDoctor.
   ///
   /// In en, this message translates to: