feat(onboarding): add notification permission step to setup wizard

[mrdulasolutions]

Summary

User report: "test notifications still fail. i think this is due to apple permissions and us not having an onboarding for settings enable permissions."

The wiring was always there — App.tsx calls `initNotifications()` at mount, which probes + (if undecided) requests permission. But the macOS prompt arrives implicitly in the middle of first-launch chaos (OAuth flows, API key paste, extensions, etc.), and is easy to miss or dismiss. Once macOS has recorded a decision it doesn't re-prompt on subsequent launches — and a fresh install that misses the implicit prompt OR has a stale TCC record from a prior install ends up with `notificationsEnabled=true` at the app level but silently denied at the OS level.

That's exactly the failure mode we hit: UI says "test sent", no banner appears. `is_permission_granted` returns true (stale record), `notify` returns success, macOS quietly drops the delivery.

What this PR does

Adds an explicit permissions step to the SetupWizard, between Extensions and Analytics.

The step:

• Explains what notifications are for and that macOS will ask once.
• "Allow notifications" button → calls Tauri's `requestPermission()` and surfaces the result inline:
  • granted → green callout, persists `notificationsEnabled=true`, button hides
  • denied → amber warning + a "Open System Settings" button that deep-links to AOS Mail's row via `x-apple.systempreferences:com.apple.preference.notifications?id=com.mrdulasolutions.aosmail` (macOS-recognized since Ventura)
  • dismissed (the "default" state) → button stays available to try again
• "Continue without notifications" exit always available — permission is optional, not a hard gate.

Wiring

• `Step` type extended with `"permissions"`.
• All three `visibleSteps` initialization paths include it between extensions and analytics, so the step indicator dots reflect the addition.
• `enterExtensionsStep()`'s "no extensions need auth" skip paths now land on `permissions` instead of jumping straight to analytics.
• The Extensions step's "Continue" button advances to `permissions` instead of analytics.

After this lands

A fresh-install user with no prior TCC record will see the macOS notification prompt explicitly inside the wizard, with surrounding copy explaining why. The bug we hit (stale TCC + no explicit prompt path → silent failure) becomes structurally avoidable.

Combined with the full state-wipe procedure documented in the wiki Troubleshooting page, a user who's hit notification breakage can: nuke → reinstall → wizard prompts cleanly → notifications work.

Test plan

• Type-check passes (`npm run typecheck`) ✓
• Lint passes (`npm run lint`) ✓
• After merge: fresh install of v0.1.9 on a TCC-clean Mac → wizard steps through credentials/oauth/extensions/permissions/analytics → macOS prompt appears during permissions step → grant → Test Notification in Settings shows a banner.

🤖 Generated with Claude Code