Add high contrast, and make remote desktop configurable

Two of the three panels still handed to GNOME, having actually checked
each rather than repeating that they were not worth owning.

Universal Access turned out to be mostly ours already: the magnifier,
pointer size, text scale, motion and dimming were all present. High
contrast was the real gap. It reaches GTK4 applications through the
desktop portal, which republishes GNOME's accessibility setting as
org.freedesktop.appearance contrast -- so no high-contrast theme is
involved, and none is installed here. Verified end to end: committing
the preference drove gsettings and the portal reported contrast 1.

Sticky, slow and bounce keys stay absent. There is no Wayland or
Hyprland implementation, and the compositor would store the XKB option
while nothing ever acted on it.

Remote desktop gained port, view-only, and clearing stored credentials.
SETTING credentials opens a terminal running grdctl, which prompts for
the password itself. That is not a hand-off for lack of effort: grdctl
takes the password on a terminal and core-dumps without one, and the
only alternative -- passing it as an argument -- would publish it
through /proc to every process on this machine. Typed into grdctl
directly it never passes through Panama, and a contract now fails if it
ever appears on a command line.

Color stays with GNOME, and not for lack of effort either. colord runs
here with seven profiles and zero devices registered, because the
daemons that register displays do not run under this session, and
Hyprland exposes no ICC, gamma, or color-management option at all. A
Color page could import a profile, attach it to nothing, and change
nothing -- the same failure refused for rollback and printer drivers.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

tests/quickshell/sharing-contract.sh

@@ -74,6 +74,21 @@ grep -q 'pkexec' <<<"$desktop_body" \
 grep -q '"--user"' <<<"$desktop_body" \
     || fail 'remote desktop is not managed as a user service'
 
+# ── The remote desktop password never passes through Panama ────────────────
+# grdctl takes it on a terminal and core-dumps without one, so the only two
+# options were a terminal hand-off or an argument -- and an argument publishes
+# it through /proc to every process on this machine.
+grep -q 'set-credentials' "$service" \
+    || fail 'the service cannot set remote desktop credentials at all'
+grep -qE 'set-credentials".*(password|secret)' "$service" \
+    && fail 'the service puts a password on the command line'
+grep -q 'set-credentials' "$helper" \
+    && fail 'the helper handles credentials; that path cannot prompt and must stay in a terminal'
+grep -q 'kitty' "$service" \
+    || fail 'credentials are not handed to a terminal, so nothing can prompt for them'
+grep -q 'clear-rdp-credentials' "$helper" \
+    || fail 'stored credentials cannot be cleared'
+
 # ── The snapshot reflects the machine ───────────────────────────────────────
 command -v jq >/dev/null 2>&1 || { printf 'sharing contract: SKIP (no jq)\n'; exit 0; }
 snapshot="$("$helper" snapshot 2>/dev/null)" || fail 'snapshot failed'