feat(web): add windowed Settings app, separate from initial Config screen

The taskbar's gear icon reopened the full-page "Connect to Oikos" screen
even once already connected. Split that: Config.svelte stays as the
first-run/unconfigured screen; a new Settings app (windowed, like Tasks or
Operations) now handles in-session changes, with a section list (Connection,
Appearance) built to grow — future settings are one more entry, not a new
screen.

- pages/Settings.svelte: Connection (server URL/token/Authentik, reusing
  config.ts + oidc.ts) and Appearance (Terracotta/Carbon picker) sections.
- apps.ts: registered as a normal desktop app.
- Taskbar's gear button now opens the Settings window; removed the
  onOpenConnection prop threaded through App -> Desktop -> Taskbar, since
  Settings' "Forget saved connection" (clear config + reload) replaces it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/lib/components/desktop-shell/Desktop.svelte

@@ -21,8 +21,6 @@
   import Undo2Icon from '@lucide/svelte/icons/undo-2'
   import Redo2Icon from '@lucide/svelte/icons/redo-2'
 
-  let { onOpenConnection }: { onOpenConnection: () => void } = $props()
-
   // Clicking the bare desktop (not an icon, not a window) blurs the focused
   // window — the familiar "click empty desktop to deselect" affordance.
   function onSurfaceClick(e: MouseEvent) {
@@ -104,7 +102,7 @@
     <WindowLayer />
   </div>
 
-  <Taskbar {onOpenConnection} />
+  <Taskbar />
 </div>
 
 {#if menuPos}