feat: sealed-area connection switch + identity bar (multi-project stage 3)

The workspace switcher now lists the operator's sealed areas (read from
~/.chain/sealed/ manifests, the same source the CLI uses) below the
shared projects, each with a lock icon and a running/stopped status.
Selecting one is a real connection switch: Studio reconnects its hub
client to the area's own port with a full state reload — one window,
one truth. A stopped area is started first (chain project start) with a
visible notice; a failure surfaces as a copyable error and rolls back to
the shared hub.

While in a sealed area an identity bar under the AppBar is painted in
the area's accent colour and names it, with a one-click Leave back to
the shared hub. The area colour is marking, not theming — Studio's blue
stays the app accent. Selecting a shared project from inside an area
switches the connection back first. The sealed connection is never
persisted across restarts.

New: SealedAreaService (manifest + PID discovery), Workspace sealed
switch logic, ChainSealedIdentityBar, SystemActions.chainProjectStart.
l10n DE+EN. flutter analyze clean; 33 tests green (switcher lists sealed
with lock+status, pill shows active area, identity bar renders in the
area colour). Runtime plumbing (discovery, start, endpoint, reach)
verified headlessly against real sealed instances under a redirected
HOME; the identity-bar screenshot is deferred (display click-automation
failed after sleep on the shared desktop — an environment issue, not a
code gap; the visible components are widget-tested).

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

CHANGELOG.md

@@ -5,6 +5,26 @@ version + `kStudioVersion` in `lib/main.dart` stay in lockstep.
 
 ## Unreleased
 
+### Added (multi-project, stage ③ — sealed areas)
+
+- **Sealed-area connection switch.** The workspace switcher now lists
+  the operator's sealed areas (read from `~/.chain/sealed/` manifests,
+  the same source the CLI uses) below the shared projects, each with a
+  lock icon and a running/stopped status. Selecting one is a real
+  connection switch: Studio reconnects its hub client to the area's own
+  port with a full state reload — one window, one truth. A stopped area
+  is started first (`chain project start`) with a visible notice; a
+  failure surfaces as a copyable error and rolls back to the shared hub.
+- **Identity bar.** While connected to a sealed area, a strip under the
+  AppBar is painted in the area's accent colour and names it, with a
+  one-click *Leave* back to the shared hub. The area colour is marking,
+  not theming — Studio's blue stays the app accent. (The window-title
+  tint is a small follow-up; the identity bar is the primary signal.)
+- Selecting a shared project or "All projects" from inside a sealed area
+  switches the connection back to the shared hub first. The sealed
+  connection is never persisted across restarts — Studio always launches
+  on the shared hub and the operator re-enters an area deliberately.
+
 ### Added (detached-runs monitor — T3 parity)
 
 - **Runs page.** A new sidebar destination lists detached invocations