fix: enforce uninstall protection in background and lock its toggle during hard sessions

[brendan-ch]

Summary

Fixes two defects in Uninstall Protection (Settings → "Uninstall Protection", which denies device app removal while a Hard Mode rule is actively blocking, so a hard block can't be escaped by uninstalling OpenAppLock):

1. Background gap (confirmed). App-removal denial was only recomputed on the foreground path (RuleEnforcer.refresh), so a Hard Mode window that started while the app was closed left the device removable (an escape hatch defeating the feature), and one that ended left protection stuck on until the next foreground. This was documented as a known v1 limitation in the spec.
2. Toggle editable mid-block. The Settings toggle had no gating and could be turned off while a Hard Mode rule was actively blocking.

What changed

• Shared key — AppGroup.uninstallProtectionKey so the Screen Time extensions can read the opt-in; AppSettingsStore points at it.
• Snapshot policy — new UninstallProtectionPolicy (in Shared/) mirrors RulePolicy's active/hard-locked semantics exactly (including the scheduled-today check for limit rules). A parity unit test asserts it never drifts from RulePolicy.
• Background enforcer — new UninstallProtectionEnforcer.reconcile() recomputes denial from the snapshots + opt-in. Called from the DeviceActivity monitor (interval start/end, usage threshold) and the ShieldAction extension (after a granted open), so denial tracks hard blocks even while the app is closed. ShieldApplying is left unchanged.
• Toggle lock — while any Hard Mode rule is actively blocking, the Settings switch is replaced by a red lock.fill (mirroring the Home "Currently Blocking" treatment) with an explanatory notice, gated by RulePolicy.canToggleUninstallProtection. The binding setter is also guarded as defense in depth.
• Spec — RULES_FEATURE_SPEC.md §6 / §6.1 updated to document both paths and the locked toggle.

Test plan

• Unit tests: snapshot-policy scenarios + RulePolicy parity, background enforcer reconcile, canToggleUninstallProtection.
• UI test: SettingsUITests.testUninstallProtectionLockedDuringHardSession (switch hidden + lock/notice shown under the hard-mode-active scenario); existing flip test still passes.
• Full suite green (218/218) via Xcode MCP.
• Manual UI validation in the simulator (locked vs. unlocked Settings states confirmed visually).
• On-device / TestFlight: the actual background denyAppRemoval transition when a hard window starts/ends with the app closed is only observable on a real device (the simulator uses mock shields and delivers no DeviceActivity callbacks).

🤖 Generated with Claude Code