settings: add safe Startup Apps manager

[alamin147]

Summary

Add a Startup Apps page that manages normal per-user login applications without exposing DMS or desktop/session infrastructure as a generic service manager.

• list and toggle XDG autostart entries from user and system configuration directories
• disable system XDG entries through user overrides without modifying /etc
• list only conservatively classified user-facing systemd application services
• change systemd enablement without --now, so running applications are not started or stopped
• add and remove DMS-created user XDG startup entries
• refresh while the page is open and integrate the page with Settings search

Safety

Systemd units are excluded by default. A service must be a persistent, loaded .service, use an allowed login target, avoid protected identities and critical session dependencies, and match a visible desktop application. Socket, timer, target, template, transient, generated, masked, static, DMS, compositor, audio, bus, portal, keyring, and session infrastructure is rejected.

The backend repeats classification before every systemd mutation. Protected entries therefore cannot be changed by calling the CLI directly. User-authored XDG files can be toggled but only entries created by DMS can be deleted.

Validation

• go test ./internal/startup ./cmd/dms
• go test -race ./internal/startup
• go vet ./internal/startup ./cmd/dms
• golangci-lint v2.13.1 run ./... — 0 issues
• make build
• settings search-index generation and validation
• QML parse/syntax checks with Qt 6 qmlformat and qmllint
• live DMS smoke test: page load, search data, application discovery, and protected direct mutation

The complete go test ./... run passes Startup Apps and the rest of the reported packages, but still hits the existing unrelated internal/screenshot TestWaylandOutputBoundsScaled failure. make test-qml could not run locally because qmltestrunner is not installed.