fix(app): the Full Disk Access step has no recovery when Uplink is not in the list

Part of #5.

What is there today

Step 1 opens the Full Disk Access pane (app/Uplink/desktop-agent.ts#L301) and the popover says "Switch on Uplink in the list. It notices within a few seconds" (app/Uplink/menubar.html#L86). The retry loop behind that promise is real and good: every five seconds while the grant is missing (app/Uplink/desktop-agent.ts#L214).

Three things are missing.

1. Uplink may not be in the list. For an app whose first protected read was refused before it was ever toggled, the row does not exist, and the pane's "+" button is the only way in. The popover does not say that, and does not reveal the bundle for the drag. The from-source path does this better: uplink:install runs open -R on the bundle (app/Commands/Uplink.ts#L180) so it is sitting in a Finder window ready to drag. The polished path lost it.
2. A rebuild voids the grant. The README states it for the source install (README.md#L98) and BUNDLE_ID exists precisely because macOS keys the grant to a bundle id plus its signature (app/Uplink/service.ts#L21). Nothing tells a DMG user that replacing the app means re-granting.
3. There is no way to tell "not granted" from "granted but chat.db unreadable". Both land in messagesError (app/Uplink/desktop-agent.ts#L199), which reports the Full Disk Access sentence for MessagesAccessError and a raw String(error) otherwise.

Proposal

1. Add a button that reveals /Applications/Uplink.app in Finder, next to the one that opens the pane, with one line saying to drag it in if it is not listed.
2. Say what the app is waiting for while it retries, and how long it has been waiting. A silent five second loop is indistinguishable from nothing happening.
3. Distinguish the two failure states in the check's detail, so a person who has granted access and still cannot read is not told to grant access again.

Requirements

• Do not claim the grant is active until a read succeeds. The retry loop is the witness.
• The pane cannot be opened to a specific app's row. Do not imply it can.
• Keep the five second retry. It is the reason this step does not need a relaunch, which is the best part of the current flow.

Acceptance

• With Uplink absent from the Full Disk Access list, the popover says how to add it and can reveal the bundle.
• After granting, the check flips without a relaunch, as it does today.
• A granted-but-unreadable database reports something other than "grant Full Disk Access".