Add layered settings, and fix a migration mechanism that silently lied

Two things, because the second could not be built on the first.

The schema stamp was part of the same execute_batch as the CREATE TABLE IF NOT
EXISTS statements, and it wrote unconditionally. Opening an older file therefore
added no columns but flipped the version forward anyway; opening a *newer* file
stamped it back down and then wrote rows the newer build could not read. Both
produced a database whose recorded version was a lie, and every future schema
change would have inherited it.

Now the version is read before anything is applied, migrations are ordered and
forward-only inside one transaction, a newer file is refused with SchemaTooNew
rather than downgraded, and a supported version raised without a step to reach
it fails at the first open instead of claiming success. Tested by stamping a
file at version 99 and asserting both the refusal and that the stamp is left
untouched.

lumbridge-settings resolves compiled default -> settings.toml -> environment.
The environment sits above the file deliberately: decision 0016 calls
LUMBRIDGE_CLAUDE_OAUTH=0 "one switch off", and a switch a config file can
silently re-enable is not a switch. A pinned value renders disabled and names
the variable, rather than accepting an edit that would do nothing.

Every field carries a WriteAuthority. Routing all writes through Configure is
the obvious design and would hand a layout-only agent the program every future
pane launches — the guarantee decision 0006 exists to make. Anything naming a
program, path or destination is Human-only, asserted by a test that reads the
path rather than trusting the author.

Four paths are permanently not settings, with the reason recorded beside each
and a test asserting their absence: the usage endpoint URL, the credentials
path, the client identity, and the shell program. A configuration file that can
redirect where an access token is sent is a credential exfiltration path with a
friendly name.

Environment access is a trait rather than std::env, because the workspace forbids
unsafe, set_var is unsafe in Rust 2024, and the layering rule has to be testable
without mutating the process running the test.

Verified live with LUMBRIDGE_CLAUDE_OAUTH=0: the account-endpoint row reads off,
greyed, "pinned by LUMBRIDGE_CLAUDE_OAUTH". The Advanced page names every file,
endpoint and child process Lumbridge touches and states that nothing is sent
anywhere else — as a fact, not as a toggle nobody can flip.

File loading, comment-preserving writes and editable controls are not in this
pass; 0022 records why that order is the honest one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/lumbridge/src/theme.rs

@@ -25,10 +25,9 @@ pub(crate) struct ThemeColors {
     pub(crate) surface: Rgba,
     pub(crate) surface_raised: Rgba,
     pub(crate) surface_active: Rgba,
-    /// Not yet painted anywhere. The command palette and the panel chooser
-    /// still sit on `surface_raised`; moving them is a visible change, and the
-    /// commit that introduced this engine is deliberately not one.
-    #[expect(dead_code, reason = "the overlay surfaces move onto it separately")]
+    /// The settings pane sits on this. The command palette and the panel
+    /// chooser still use `surface_raised`; moving them is a visible change and
+    /// belongs in a commit that says so.
     pub(crate) surface_overlay: Rgba,
     pub(crate) border: Rgba,
     pub(crate) border_quiet: Rgba,
@@ -45,6 +44,9 @@ pub(crate) struct ThemeColors {
     /// The needs-input row tint, which arrives with the sidebar rework.
     #[expect(dead_code, reason = "the attention row is rebuilt with the sidebar")]
     pub(crate) attention_wash: Rgba,
+    /// The dimming behind a modal. Translucent, so what it covers stays legible
+    /// as context rather than disappearing.
+    pub(crate) scrim_wash: Rgba,
 }
 
 /// Widens an 8-bit channel into the 0..=1 float GPUI wants.
@@ -79,6 +81,10 @@ impl From<&Palette> for ThemeColors {
             danger_container: rgba(palette.danger_container),
             attention: rgba(palette.attention),
             attention_wash: rgba(palette.attention_wash),
+            scrim_wash: Rgba {
+                a: 0.55,
+                ..rgba(palette.scrim)
+            },
         }
     }
 }