Add a Privacy & Security page

Continuing towards GNOME Settings parity. GNOME's Privacy panel covers
screen lock, camera and microphone access, file history, trash, and
device security; Panama had no equivalent page at all, despite already
tracking camera and microphone use for the bar indicator.

Device security is a new read-only readout: Secure Boot, TPM, disk
encryption, SELinux mode, and the firewall. None of these is a
preference -- they are set in firmware, at install time, or by system
policy, and a switch offering to change them would either fail or do
something far-reaching from a control that looks like every other
control. What it answers is "is this machine set up the way I think it
is", which otherwise takes five commands and root. Facts that cannot be
determined report Unknown rather than guessing, because a security
readout that quietly says "fine" when it failed to look is worse than
no readout.

File history and trash retention are deliberately NOT offered as
switches. They are GNOME preferences enforced by gsd-housekeeping, which
does not run in a Hyprland session -- verified, it is not running here.
Toggling them would store a preference, change nothing, and give no sign
of it. They are delegated to GNOME Settings by name instead.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

config/dot/quickshell/services/DeviceSecurity.qml

@@ -0,0 +1,54 @@
+pragma Singleton
+
+// Read-only device security facts: Secure Boot, TPM, disk encryption, SELinux,
+// firewall.
+//
+// Nothing here is a preference. These are set in firmware, at install time, or
+// by system policy, and a settings app that offered to change them from a
+// switch would either fail or do something far-reaching from a control that
+// looks like every other control. What this answers is "is this machine set up
+// the way I think it is", which otherwise takes five commands and root.
+//
+// Read on demand. None of these can change while the desktop is running,
+// short of a reboot.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-security"
+
+    // [{ label, value, ok, detail }]
+    property var facts: []
+    property bool scanned: false
+
+    // The facts that are not in their reassuring state. The page leads with the
+    // count so a machine that is entirely fine says so in one line instead of
+    // making the user read five rows to find out.
+    readonly property int attentionCount: root.facts.filter(fact => !fact.ok).length
+
+    function refresh(): void {
+        if (!query.running)
+            query.running = true;
+    }
+
+    Process {
+        id: query
+        command: [root.helperPath]
+        stdout: StdioCollector {
+            onStreamFinished: {
+                try {
+                    const parsed = JSON.parse(this.text);
+                    root.facts = Array.isArray(parsed) ? parsed : [];
+                } catch (error) {
+                    root.facts = [];
+                    console.warn("DeviceSecurity: could not parse helper output:", error);
+                }
+                root.scanned = true;
+            }
+        }
+    }
+}