feat(sync): per-domain settings sync control

[kipavy]

Part 1 of #42. Adds per-domain cloud-sync control: a user can switch sync off for Themes, Interface, Shortcuts, App settings or Recent people, and the held-back domain never enters the uploaded blob.

Per-setting (leaf-level) control is PR 2 and is not in this change.

What changed

The guarantee is enforced at write time. settings.json is both the local merge base and part of the encrypted blob (backup_export slurps every *.json in the config dir), so a switched-off domain has to be absent from that file, not merely ignored on arrival. push() now writes filterOutgoing(buildUserDataBundle()) before the exporter reads it, and filterIncoming drops switched-off sections from a remote bundle before the merge.

The duplicate theme wire is retired. Themes previously travelled twice: the themes bundle section and the whole theme.json file, which the exporter uploaded wholesale and applyRemoteTheme applied on pull. The second wire would have defeated the toggle entirely. It is gone, and backup_export gained a generic skip_files parameter (mirroring the existing excluded_ids) to withhold named config files.

That deletion is only safe because themesHandler was first widened to carry the six fields only theme.json held — mode, lightThemeId, darkThemeId, both schedule times, and location. Verified on the live app: without that, auto light/dark and the scheduled switch would have silently stopped syncing.

Re-enabling publishes this device. Each handler gained touch(). Switching a domain back on stamps it as changed now, so a value curated locally while sync was off is not lost to the other device's newer timestamp. Switching a domain off also schedules a push, so the copy already on the server is withdrawn rather than sitting there indefinitely.

Settings → Sync gains a second toggle group. vaults is deliberately absent — it is tombstone-merged data, not a preference, and switching it off would strand deletes.

Verification

Live, on a real decrypted blob (headless build, WebDriver), run twice — once mid-branch and again at final HEAD:

	themes ON	themes OFF
theme.json in blob	false	false
themes section in blob	true	false
activeThemeId	"voltius-light"	null
mode (automation)	"manual"	null

With themes off, only that section disappears — the other five survive. Plugin destinations skip [] when themes are on and ["theme.json"] when off.

Suites: 490 files / 3793 tests green; tsc --noEmit clean; cargo test commands::sync 7/7.

Behaviour changes worth knowing

• Importing a settings bundle with Themes selected now replaces this device's custom themes rather than merging them, and publishes that deletion to your other devices. This is what makes a theme deletion propagate at all. The import UI now warns when the bundle contains a themes section.
• mergeUserDataBundle reads live stores when a section is missing from the local merge base. Without it, re-enabling a domain let a stale remote win unconditionally — lastWriteWins never compared timestamps because the local side was absent. Handlers' export() must stay side-effect free; that is now stated on the interface.
• Server and plugin destinations differ deliberately. The server always withholds theme.json (themes travel in the bundle); plugin/gist destinations withhold it only when themes are off, because that path applies theme.json directly and never applies the settings bundle. Deleting its wire would have silently ended theme sync for gist users.

Needs a human

Russian strings are machine-written and want a native check — раскладки for "layouts" reads as keyboard layout in common usage, which collides with the separate Shortcuts domain (макет/компоновка suggested), and Недавние люди is a stiff calque.

Cross-version

An older client pulling a new blob finds no theme.json, keeps its local theme, and still receives themes through the bundle section — present since v0.1.40. A newer client pulling an older blob ignores the theme.json still in it.