feat: sealed-area connection switch + identity bar (multi-project stage 3)

The workspace switcher now lists the operator's sealed areas (read from
~/.chain/sealed/ manifests, the same source the CLI uses) below the
shared projects, each with a lock icon and a running/stopped status.
Selecting one is a real connection switch: Studio reconnects its hub
client to the area's own port with a full state reload — one window,
one truth. A stopped area is started first (chain project start) with a
visible notice; a failure surfaces as a copyable error and rolls back to
the shared hub.

While in a sealed area an identity bar under the AppBar is painted in
the area's accent colour and names it, with a one-click Leave back to
the shared hub. The area colour is marking, not theming — Studio's blue
stays the app accent. Selecting a shared project from inside an area
switches the connection back first. The sealed connection is never
persisted across restarts.

New: SealedAreaService (manifest + PID discovery), Workspace sealed
switch logic, ChainSealedIdentityBar, SystemActions.chainProjectStart.
l10n DE+EN. flutter analyze clean; 33 tests green (switcher lists sealed
with lock+status, pill shows active area, identity bar renders in the
area colour). Runtime plumbing (discovery, start, endpoint, reach)
verified headlessly against real sealed instances under a redirected
HOME; the identity-bar screenshot is deferred (display click-automation
failed after sleep on the shared desktop — an environment issue, not a
code gap; the visible components are widget-tested).

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/data/sealed_areas.dart

@@ -0,0 +1,158 @@
+// SealedAreaService — discovers the operator's sealed project
+// instances by reading their manifests directly, the same way the
+// CLI's `chain project list` does.
+//
+// A sealed project is NOT a row in the shared hub's registry — it is
+// its own hub instance (own data dir, port, store config). The shared
+// hub never learns it exists (docs/architecture/projects.md). So
+// Studio cannot ask a hub for the list; it scans the manifest
+// directory itself:
+//
+//   ~/.chain/sealed/<slug>/project.json         — the manifest
+//   ~/.chain/run/sealed-<slug>.pid              — running PID (if up)
+//   ~/.chain/run/sealed-<slug>.endpoint         — bound endpoint (if up)
+//
+// This mirrors crates/chain_runtime_mgmt/src/sealed.rs. Reading the
+// real ~/.chain honours the operator's actual areas; a test harness
+// redirects $HOME so it never touches them.
+
+import 'dart:convert';
+import 'dart:io';
+
+/// One sealed project instance as Studio needs it for the switcher
+/// and the connection switch.
+class SealedArea {
+  final String slug;
+  final String name;
+
+  /// Accent colour hex (e.g. `#e0a458`), empty when unset. This is
+  /// the area's identity colour — the marking on the switcher and
+  /// the identity bar. (Studio's blue stays the app accent.)
+  final String color;
+
+  /// Fixed loopback port of the instance's hub.
+  final int port;
+
+  /// True when the instance's hub daemon is currently running (a
+  /// live PID in `~/.chain/run/sealed-<slug>.pid`).
+  final bool running;
+
+  const SealedArea({
+    required this.slug,
+    required this.name,
+    required this.color,
+    required this.port,
+    required this.running,
+  });
+
+  /// Loopback gRPC endpoint of the instance's hub.
+  String get endpoint => 'http://127.0.0.1:$port';
+
+  @override
+  bool operator ==(Object other) =>
+      other is SealedArea &&
+      other.slug == slug &&
+      other.name == name &&
+      other.color == color &&
+      other.port == port &&
+      other.running == running;
+
+  @override
+  int get hashCode => Object.hash(slug, name, color, port, running);
+}
+
+class SealedAreaService {
+  SealedAreaService._();
+  static final SealedAreaService instance = SealedAreaService._();
+
+  /// `~/.chain` root, or null when the home dir can't be determined.
+  String? _chainHome() {
+    final home =
+        Platform.environment['HOME'] ?? Platform.environment['USERPROFILE'];
+    if (home == null || home.isEmpty) return null;
+    return '$home${Platform.pathSeparator}.chain';
+  }
+
+  /// Every sealed area found under `~/.chain/sealed/`, sorted by
+  /// display name (case-insensitive). Soft-fails to an empty list —
+  /// an unreadable or absent directory is the normal "no sealed
+  /// areas" case, not an error.
+  Future<List<SealedArea>> list() async {
+    final base = _chainHome();
+    if (base == null) return const [];
+    final sep = Platform.pathSeparator;
+    final dir = Directory('$base${sep}sealed');
+    if (!dir.existsSync()) return const [];
+
+    final areas = <SealedArea>[];
+    for (final entry in dir.listSync()) {
+      if (entry is! Directory) continue;
+      final manifest = File('${entry.path}${sep}project.json');
+      if (!manifest.existsSync()) continue;
+      try {
+        final m = jsonDecode(manifest.readAsStringSync()) as Map<String, dynamic>;
+        final slug = (m['slug'] as String?) ?? '';
+        final port = (m['port'] as num?)?.toInt() ?? 0;
+        if (slug.isEmpty || port == 0) continue;
+        areas.add(
+          SealedArea(
+            slug: slug,
+            name: (m['name'] as String?)?.isNotEmpty == true
+                ? m['name'] as String
+                : slug,
+            color: (m['color'] as String?) ?? '',
+            port: port,
+            running: _isRunning(base, sep, slug),
+          ),
+        );
+      } catch (_) {
+        // Skip an unparseable manifest rather than failing the list.
+      }
+    }
+    areas.sort(
+      (a, b) => a.name.toLowerCase().compareTo(b.name.toLowerCase()),
+    );
+    return areas;
+  }
+
+  /// True when `~/.chain/run/sealed-<slug>.pid` holds a live PID.
+  bool _isRunning(String base, String sep, String slug) {
+    try {
+      final pidFile = File('$base${sep}run${sep}sealed-$slug.pid');
+      if (!pidFile.existsSync()) return false;
+      final pid = int.tryParse(pidFile.readAsStringSync().trim());
+      if (pid == null) return false;
+      return _pidAlive(pid);
+    } catch (_) {
+      return false;
+    }
+  }
+
+  /// Liveness probe without killing: `kill -0` on POSIX, tasklist on
+  /// Windows. Matches the CLI's is_pid_alive semantics closely
+  /// enough for a UI status dot.
+  bool _pidAlive(int pid) {
+    try {
+      if (Platform.isWindows) {
+        final r = Process.runSync('tasklist', ['/FI', 'PID eq $pid']);
+        return r.stdout.toString().contains('$pid');
+      }
+      final r = Process.runSync('kill', ['-0', '$pid']);
+      return r.exitCode == 0;
+    } catch (_) {
+      return false;
+    }
+  }
+
+  /// Read the bound endpoint the instance's daemon wrote, if any.
+  /// Falls back to the manifest port when the run-file is absent.
+  Future<String?> boundEndpoint(String slug) async {
+    final base = _chainHome();
+    if (base == null) return null;
+    final sep = Platform.pathSeparator;
+    final f = File('$base${sep}run${sep}sealed-$slug.endpoint');
+    if (!f.existsSync()) return null;
+    final raw = f.readAsStringSync().trim();
+    return raw.isEmpty ? null : raw;
+  }
+}