feat: support external File Provider storage on macOS

[OpenCow42]

Summary

• use the Apple-supported volume-backed NSFileProviderDomain initializer on macOS and gate every choice through checkDomainsCanBeStoredOnVolume(at:)
• add stable configuration identity, exact registered-domain handling, opaque extension bindings, and a durable relocation journal
• support recoverable moves between this Mac and eligible external volumes while preserving dirty local data and known-folder ownership
• add macOS add/change/repair storage UI, placement health in Status, and actionable disconnected-volume messaging
• keep iOS and visionOS on their existing local-domain behavior
• update lifecycle, persistence, cleanup, architecture, and physical test documentation

Validation

• focused macOS external-storage matrix passed: identity/migration, binding codec, relocation journal, volume eligibility/registration, app-model move/rollback/repair, placement status, known-folder lifecycle, and uninstall cleanup
• macOS build passed
• iOS Simulator build passed on iPhone 17 / iOS 26.5
• generic visionOS build passed
• git diff --check main...HEAD passed

Review notes

This is a draft until the physical external-drive matrix in doc/TESTING_AND_DEVELOPMENT.md is exercised with eligible encrypted APFS media, including unplug/replug, launch-while-missing, move rollback, and logout/removal behavior.

The broad legacy macOS test target still has a pre-existing networking-test isolation problem around the shared KDriveJSONRequestCapturingURLProtocol: the create-upload operation can stall, and parallel runs can race the lazy-download capture. The new feature suites pass cleanly and do not use that capture.

Apple references:

• https://developer.apple.com/documentation/fileprovider/nsfileproviderdomain/init(displayname:userinfo:volumeurl:)
• https://developer.apple.com/documentation/fileprovider/nsfileprovidermanager/checkdomainscanbestoredonvolume(at:)