Carry settings between machines by allow-list, not by stripping

panama-settings-backup already snapshots this machine so it can be put back
exactly as it was, arrangement and all. This is the other thing: an export meant
to travel, carrying the preferences that describe taste rather than hardware.

The export is an allow-list read from the preference schema rather than a
deny-list of things to remove. A key added later that happens to hold a token
cannot leak into a file somebody emails to themselves; being wrong in this
direction loses a setting, being wrong the other way publishes a secret. It
earned that immediately -- this machine's store holds an orphaned shadowOffset
from a setting that no longer exists anywhere in the source, and it was left
behind without anyone having to know about it.

Three settings stay: the display arrangement, which is keyed by output names
that mean nothing elsewhere; the last page opened, which is session noise; and
schemaVersion, which belongs to the store rather than to a person. Import is a
merge, so settings a file does not mention are left alone, and it is idempotent.

Two bugs made and caught here, in opposite directions. Validation missed 36
settings because "real" was spelled "float" and enums fell through entirely, so
an out-of-range or nonsense value would have been written straight into the
store. Correcting that then broke numeric enums -- vrrPolicy is an enum of 0..3
and the options were read with a regex that only matched quoted values, so those
settings had no known choices, were declared unverifiable and were refused:
valid settings dropped silently in transit.

The contract could not see the second one. It checked only that bad values are
refused, and when numeric enums were unreadable they never reached the bundle at
all, so every "did it arrive" assertion was satisfied by their absence. It now
requires the export to carry what it should as well as withhold what it should
not, and was verified to fail in both directions.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

config/dot/quickshell/modules/settings/DesktopPage.qml

@@ -123,6 +123,71 @@ SettingsPage {
         SliderRow { setting: "focusDurationMinutes"; divider: false }
     }
 
+    // Distinct from the snapshots below, which put THIS machine back as it
+    // was. This carries settings to a different one, and deliberately leaves
+    // behind anything that describes hardware.
+    SettingsCard {
+        title: "Carry settings to another machine"
+        subtitle: SettingsSync.lastError !== ""
+            ? SettingsSync.lastError
+            : "Everything except what describes this machine: the display arrangement stays here."
+
+        ActionRow {
+            label: "Export"
+            detail: SettingsSync.lastAction === "export" && SettingsSync.carried > 0
+                ? SettingsSync.carried + " settings written to " + SettingsSync.defaultPath
+                : "Writes " + SettingsSync.defaultPath
+            action: "Export"
+            enabled: !SettingsSync.busy
+            onTriggered: SettingsSync.exportTo(SettingsSync.defaultPath)
+        }
+
+        ActionRow {
+            label: "See what an import would change"
+            detail: SettingsSync.previewed
+                ? SettingsSync.changes.length + " would change, "
+                  + SettingsSync.skipped.length + " skipped"
+                : "Reads " + SettingsSync.defaultPath + " without applying anything"
+            action: "Preview"
+            enabled: !SettingsSync.busy
+            onTriggered: SettingsSync.preview(SettingsSync.defaultPath)
+        }
+
+        // Only offered once a preview has said what it would do. Importing
+        // settings sight unseen is how somebody ends up wondering why their
+        // desktop changed.
+        ActionRow {
+            visible: SettingsSync.previewed && SettingsSync.changes.length > 0
+            label: "Apply those " + SettingsSync.changes.length + " changes"
+            detail: "Settings the file does not mention are left alone"
+            action: "Import"
+            enabled: !SettingsSync.busy
+            onTriggered: SettingsSync.importFrom(SettingsSync.defaultPath)
+        }
+
+        Repeater {
+            model: SettingsSync.previewed ? SettingsSync.skipped : []
+
+            delegate: TextRow {
+                required property var modelData
+                width: parent.width
+                label: String(modelData.key ?? "")
+                detail: "Skipped: " + String(modelData.reason ?? "")
+                value: ""
+            }
+        }
+
+        TextRow {
+            visible: SettingsSync.lastAction === "import" && SettingsSync.lastError === ""
+            label: SettingsSync.applied === 0
+                ? "Nothing needed changing"
+                : SettingsSync.applied + " settings applied"
+            detail: "From " + (SettingsSync.exportedFrom || "the export")
+            value: ""
+            divider: false
+        }
+    }
+
     SettingsCard {
         title: "Snapshots"
         subtitle: SettingsBackup.lastError !== ""