engine: per-app exclusion list — never watch or act in these apps

[hvardhan878]

Problem

Ghostwork observes everything. There are apps where you never want it to learn or fire — password managers, banking apps, personal journaling apps, health apps, etc. Right now there's no way to say "never touch 1Password".

What to build

A Excluded Apps setting — a comma-separated list (or add/remove chips UI) of macOS app names. Two behaviours:

1. Observation exclusion — the session ingester skips ui_monitoring rows where app_name is in the exclusion list (before inserting into raw_events)
2. Execution exclusion — the action engine skips rule matching when the frontmost app is excluded

A default list of sensitive apps should ship pre-populated:
1Password, Keychain Access, Mint, Robinhood, Banking, Health, Passwords

Acceptance criteria

• Settings tab has an "Excluded Apps" field (editable list)
• Exclusion list is persisted via settings.set("excluded_apps", ...)
• Session ingester reads the list and skips matching rows
• Action engine getCurrentContext() returns early if frontmost app is excluded
• Default list ships pre-populated with common sensitive apps

Files to look at

• src/main/sessionIngester.ts — where ui_monitoring rows are processed
• src/main/actionEngine.ts — where getCurrentContext() is called
• src/main/db.ts — getSettings() / setSetting() helpers
• src/renderer/index.html — Settings tab UI