P5: settings, persistence, polkit packaging, README

Backend
- regenerate_identity command stops the daemon, deletes
  priv_key.bin, leaves the user to restart for a fresh identity;
  falls back to the canonical XDG path when sidecar.key_path()
  isn't populated yet
- tauri.conf.json ships the polkit policy via deb.files mapping;
  src-tauri/packaging/polkit/tech.threefold.mycellium-ui.policy
  declares the spawn action with auth_admin_keep so the dialog
  appears once per session

Frontend
- config store persists SidecarConfig (peers, tunName, noTun)
  through tauri-plugin-store; App.vue reads it and forwards to
  start_daemon, replacing the hard-coded defaults
- Settings view: daemon-config form, identity panel with the
  destructive regenerate button, sidecar log viewer, About
- README rewritten end-to-end: HTTP-loopback architecture, polkit
  install path, build commands, verification matrix, and a
  honest "known limitations" section

src-tauri/packaging/polkit/tech.threefold.mycellium-ui.policy

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "https://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+  <vendor>Threefold</vendor>
+  <vendor_url>https://threefold.io</vendor_url>
+
+  <action id="tech.threefold.mycellium-ui.spawn">
+    <description>Run the Mycelium overlay daemon</description>
+    <description xml:lang="fr">Lancer le démon de l'overlay Mycelium</description>
+    <message>Authentication is required to start the Mycelium overlay daemon.</message>
+    <message xml:lang="fr">Une authentification est requise pour démarrer le démon Mycelium.</message>
+    <defaults>
+      <allow_any>auth_admin</allow_any>
+      <allow_inactive>auth_admin</allow_inactive>
+      <!-- Cache the authentication for the user's session so the polkit
+           dialog only appears once per login (5-minute window). To allow
+           passwordless start for trusted desktops, change to "yes" — be
+           aware this lets any process on the machine spawn the daemon. -->
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+  </action>
+</policyconfig>