Make the Dock editable and add settings snapshots

The Dock's pinned applications were a sixteen-entry literal in
Settings.qml, so changing what sits in the Dock meant editing QML. They
are now an ordered list in the shared store, with move up, move down,
unpin, and a filtered picker for adding installed applications. Keeping
them in the shared store rather than a file of their own means they are
covered by Restore defaults like everything else.

This needed a "json" schema type for values the schema stores and resets
but does not validate field by field. It exists so structured settings
can live in the one file rather than growing a fourth preference store;
the owning service validates the contents.

Snapshots make the settings app safe to experiment with. The whole
configuration is one file, so a backup is a copy and a restore is an
overwrite, and restoring snapshots what it replaces so it is itself
undoable. A snapshot is validated as JSON before it can be restored over
a working configuration, and a name that is not a plain snapshot
filename from the backup directory is refused.

Snapshot names carry milliseconds. At one-second resolution a save
followed promptly by a restore produced the same filename twice, and the
restore's own safety snapshot overwrote the file it was about to read --
found by the contract, which restores immediately after saving.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

config/dot/quickshell/config/PreferenceSchema.qml

@@ -15,7 +15,7 @@ pragma Singleton
 //
 // Entry fields
 //   key      unique identifier; also the JSON key on disk
-//   type     "bool" | "int" | "real" | "string" | "enum"
+//   type     "bool" | "int" | "real" | "string" | "enum" | "json"
 //   def      shipped default, used when the file is absent or a value is invalid
 //   min/max  inclusive bounds for int and real; values outside are clamped
 //   step     UI increment for int and real
@@ -25,6 +25,13 @@ pragma Singleton
 //   detail   one line explaining what changing it does
 //   internal true for state the shell keeps but the user never edits directly
 //   pattern  for "string": a regular expression the value must match in full
+//
+// "json" holds a structured value -- a list or an object -- that the schema
+// stores and resets but does not validate field by field. It exists so that
+// settings like the dock's pinned applications live in the same file, and are
+// covered by the same reset, as everything else rather than growing a fourth
+// preference store. The service that owns such a value is responsible for
+// validating it; see services/Dock-related consumers.
 //   hypr     present when the setting maps onto an Hyprland option:
 //              path    the hl.config table path, e.g. ["decoration","blur","size"]
 //              option  the getoption path used to read the value back
@@ -465,6 +472,26 @@ Singleton {
             ]
         },
 
+        // ── Dock contents ───────────────────────────────────────────────────
+        // A "json" value: the ordered list of desktop entry ids pinned to the
+        // dock. Kept in the shared store so that reordering the dock is covered
+        // by Restore defaults like everything else, rather than living in its
+        // own file. The shipped order is the GNOME dash it replaced.
+        {
+            key: "dockPinned", type: "json", group: "dock",
+            label: "Pinned applications",
+            detail: "Applications that stay in the Dock whether or not they are running",
+            def: [
+                "org.gnome.Settings", "kitty", "org.gnome.Nautilus",
+                "com.bitwarden.desktop", "org.gnome.Software", "helium",
+                "org.mozilla.thunderbird_esr", "com.slack.Slack",
+                "app.bluebubbles.BlueBubbles", "rustdesk",
+                "io.podman_desktop.PodmanDesktop", "claude-desktop",
+                "codex-desktop", "md.obsidian.Obsidian",
+                "com.obsproject.Studio", "steam"
+            ]
+        },
+
         // ── Internal ────────────────────────────────────────────────────────
         {
             key: "lastPage", type: "string", def: "home", group: "internal",
@@ -542,6 +569,13 @@ Singleton {
         case "enum":
             return entry.options.some(option => option.value === value) ? value : undefined;
 
+        case "json":
+            // Accepted as-is. Anything JSON.parse produced is representable,
+            // and per-field meaning belongs to the owning service rather than
+            // here. A scalar is rejected so a corrupt file falls back to the
+            // default instead of handing a list-shaped consumer a number.
+            return (typeof value === "object") ? value : undefined;
+
         case "string": {
             const text = typeof value === "string" ? value : String(value);
             // A constrained string is rejected rather than sanitised. Several