gui: native libadwaita-free UI backend + dark shell; packaging/iso updates

- gui/ui: native GTK4 widget vocabulary (.tn-*) behind the ui.* seam,
  default backend now native; style_apple.css design language
- shell: sidebar/topbar/content all #0f0f0f in dark (matches eww panels)
- new pages: wine, online_accounts
- packaging: tanin-icons (accent folder theme), tanin-calendar, gtklock,
  taninux-gtk3-theme, flatpak install handler
- iso/distro: profile + manifest tweaks (ISO binary not included)

iso/build-profile/airootfs/etc/calamares/modules/shellprocess-striplive.conf

@@ -1,12 +1,13 @@
 ---
 dontChroot: false
 timeout: 30
-# Remove the live-only installer bits from the installed target so it boots the
-# desktop (greetd) instead of auto-launching Calamares.
+# Turn the cloned live image into a normal installed system:
+#  - drop the live installer launcher
+#  - restore the greetd config to the tanin-greet greeter (the live used an
+#    initial_session that auto-ran Calamares)
+#  - boot to the desktop; seatd is live-only (greetd uses logind on the target)
 script:
-- "rm -f /etc/systemd/system/getty@tty1.service.d/autologin.conf"
-- "rmdir --ignore-fail-on-non-empty /etc/systemd/system/getty@tty1.service.d 2>/dev/null || true"
-- "rm -f /root/.zprofile"
 - "rm -f /usr/local/bin/tanin-installer"
+- "install -Dm644 /usr/share/tanin/greetd/config.toml /etc/greetd/config.toml"
 - "systemctl set-default graphical.target"
 - "systemctl disable seatd.service"

iso/build-profile/airootfs/etc/systemd/system/getty@tty1.service.d/autologin.conf

@@ -1,3 +1,3 @@
 [Service]
 ExecStart=
-ExecStart=-/usr/bin/agetty --autologin root --noclear %I 38400 linux
+ExecStart=-/usr/bin/agetty --noreset --noclear --autologin root - ${TERM}

iso/build-profile/airootfs/root/.zprofile

@@ -1,5 +0,0 @@
-# Live ISO: auto-launch the TANINUX installer on the first console.
-# (Removed from the installed target by Calamares' shellprocess-striplive.)
-if [[ "$(tty)" == /dev/tty1 ]] && [[ -z "$WAYLAND_DISPLAY" ]] && ! pgrep -x cage >/dev/null 2>&1; then
-  exec tanin-installer
-fi

iso/build-profile/airootfs/root/customize_airootfs.sh

@@ -14,14 +14,27 @@ pacman-key --lsign-key 63F0415879323F6BFE0FBFB2B6FDF356206AF4F6
 
 # --- services in the LIVE image ---
 systemctl enable NetworkManager.service
-# seat manager for cage (the getty-autologin root session has no logind seat).
 systemctl enable seatd.service
-gpasswd -a root seat 2>/dev/null || true
-# Live boots to a console on tty1 that auto-launches the installer (cage +
-# calamares) via getty autologin + /root/.bash_profile. No display-manager.
-systemctl set-default multi-user.target
-# greetd is for the TARGET only (Calamares enables it post-install).
-systemctl disable greetd.service 2>/dev/null || true
+
+# Live: greetd auto-launches the installer (cage + calamares) via initial_session.
+# greetd creates a real logind session WITH A SEAT (the getty-autologin couldn't),
+# so cage/wlroots starts. No login prompt — the installer comes up directly.
+# (The tanin-greet package set config.toml to its greeter; we override it here for
+#  the live, and Calamares restores the tanin-greet config on the target.)
+cat > /etc/greetd/config.toml <<'GEOF'
+[terminal]
+vt = 1
+
+[initial_session]
+command = "cage -s -- calamares"
+user = "root"
+
+[default_session]
+command = "agreety --cmd /bin/zsh"
+user = "greeter"
+GEOF
+systemctl enable greetd.service
+systemctl set-default graphical.target
 
 # --- plymouth: add the hook so the target initramfs shows the splash ---
 # (Calamares regenerates the initramfs on the target; this drop-in is carried