feat(project): add project trust and restricted execution mode (#517)

Projects now open with a user-owned trust decision. The prompt offers Preview in Restricted Mode, Don't Open and Trust Project, with an optional trusted parent folder; preview is the default focus so Enter never grants trust.

Restricted projects keep browsing, editing, saving, search and highlighting. Project-controlled execution is denied by default in the backend: run, debug, build, tools, language servers, plugins and Git commands that could honour repository configuration. Trusting a project enables those paths without reopening it, and decisions can be revoked in Settings.

Terminals stay available when the user opens one, without project shell settings, environment or virtualenv activation. A shell prompt that runs git in the folder can still honour the repository's core.fsmonitor.

Fixes #462

src-tauri/src/remote_dev.rs

@@ -53,6 +53,28 @@ type Channels = Arc<Mutex<HashMap<u64, (Channel<ChannelFrame>, u64)>>>;
 #[derive(Default)]
 pub struct Connections(Mutex<HashMap<String, Arc<Connection>>>);
 
+impl Connection {
+    pub async fn authorize_command(&self, window: &str, command: &str) -> IdeResult<()> {
+        if ide_host::trust::restricted_command_allowed(command) {
+            return Ok(());
+        }
+        let project: Option<ide_host::ops::project::ProjectInfo> = self
+            .peer
+            .request(
+                "invoke",
+                Invoke { window: window.to_owned(), cmd: "project_current".into(), args: serde_json::json!({}) },
+                None,
+            )
+            .await
+            .map_err(ide_host::rpc::error_from_reply)?;
+        if project.is_some_and(|p| p.trusted) {
+            Ok(())
+        } else {
+            Err(IdeError::unavailable("Project is in Restricted Mode"))
+        }
+    }
+}
+
 impl Connections {
     pub fn get(&self, window: &str) -> Option<Arc<Connection>> {
         self.0.lock().get(window).cloned()