fix(v2.4.1): recover from cdhash mismatch, menu bar binding label, tap-failure UX

[PatelUtkarsh]

Summary

v2.4.0 had a silent failure mode that hit on the first launch after every release: the ad-hoc-signed binary has a fresh cdhash, so AXIsProcessTrusted returns false even though the TCC entry says "granted". The app showed full onboarding, the hotkey listener never started, and the user had no signal anything was wrong — fn just did nothing.

This patch addresses the root issue plus four related UX gaps in one release.

Changes

• Menu bar shows the actual binding. Hotkey: Hold fn was hardcoded. Now driven by HotKeyBindingStore and updates live when the user rebinds in Settings.
• Onboarding polling reduced from 0.5s to 2s and stops when ready. The previous loop hammered TCC with paired TCCAccessRequest() IPCs every 500ms.
• Onboarding auto-completes the moment all permissions land. Previously the user had to click "Get Started" to actually start the hotkey listener, even after granting AX in System Settings. The auto-complete avoids the trap where AX is granted but fn still doesn't work because they haven't clicked the button.
• Slim re-approval flow on cdhash mismatch. New onboardingCompleted UserDefaults flag. On launch: if the flag is set and only Accessibility is missing, show a small ReapproveAccessibilityView ("remove + re-add AudioType in Accessibility") that auto-dismisses when access returns. No more forcing the full first-run flow after every release.
• Surface tap-creation failure. HotKeyManager now posts .hotKeyTapCreationFailed when CGEvent.tapCreate returns nil. MenuBarController catches that, switches to the error-tinted icon, sets the status row to "Accessibility permission required", and turns the hotkey menu item into a clickable "Open Accessibility Settings…" shortcut. Replaces the previous silent failure.
• Bump to 2.4.1.

Verification

• swift build clean.
• Manual checklist:
  • Default fn still records (regression).
  • Settings → Change → Right Cmd; menu bar item updates to "Hotkey: Hold Right Cmd" immediately.
  • Quit + relaunch the new binary on a machine where v2.4.0 was previously authorized: re-approve flow appears, not full onboarding.
  • With AX revoked, launch app: menu bar icon turns red, status row says "Accessibility permission required", clicking the hotkey item opens System Settings.