Snapshot automatically before restoring defaults

Restoring defaults clears every preference and the Home accessory store,
and nothing in the app can undo it. Snapshots existed but were entirely
manual, so the one irreversible action Panama offers was also the one
with no safety net.

It now snapshots first. Not fatal if that fails: someone who asked to
reset gets their reset, and a snapshot that could not be written is
reported rather than allowed to block what they asked for.

The wiring is inverted deliberately. SettingsBackup already references
SystemSettings, so referencing it back would make two singletons depend
on each other, which is an initialisation-order problem waiting to
happen. Instead SystemSettings exposes a seam defaulting to a no-op and
SettingsBackup installs itself into it at startup -- the same shape as
the seams the reset path already uses for test isolation.

The contract asserts the snapshot is FIRST in the call sequence, not
merely present. A snapshot taken after the stores were cleared would
faithfully record the wiped state as the user's own, which is worse than
no snapshot: it looks like a safety net and is a copy of the damage.
Verified against both mutations -- removing the snapshot, and moving it
after the wipe.

One trap, hit for the third time today: QML allows only one
Component.onCompleted per object, and SettingsBackup already had one.
Adding a second does not fail locally -- it poisons the entire services
module, so every singleton reports "Type X unavailable" and the real
error is the last line of a forty-line cascade.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

tests/quickshell/settings-commit-reset-contract.sh

@@ -136,7 +136,14 @@ jq -e '.count == 1 and .initialized == true' <<<"$home_before" >/dev/null \
 sleep 0.6
 
 reset_state="$(qs_for_harness ipc call settings-system-test resetState)"
+# The snapshot must come FIRST. Restoring defaults is the only irreversible
+# action Panama offers, and a snapshot taken after the stores were cleared would
+# faithfully record the wiped state as if it were the user's.
+jq -e '.calls[0] == "snapshot"' <<<"$reset_state" >/dev/null \
+    || fail "reset did not snapshot before wiping the stores: $reset_state"
+
 jq -e '.calls == [
+    "snapshot",
     "display.block:true",
     "keybinds.reload",
     "wallpaper.set:",