fix: Microphone permission never prompted on first launch

[jatinkrmalik]

Problem

On first launch via DMG, the microphone permission prompt is never shown. The app immediately marks mic permission as denied and logs it that way — without ever asking the user. Once in this state, there's no way to re-trigger the system prompt.

Root Cause

Two bugs working together:

1. AudioEngine.checkPermission() treated .notDetermined as .denied — Both cases returned false, so AppState could never distinguish a first launch from an explicit denial.

2. performStartup() never called requestMicrophonePermission() — It only called checkPermissions(), which silently marked mic as denied without triggering the system prompt.

Fix

AudioEngine

• Replaced boolean checkPermission(completion:) with tri-state checkPermissionStatus() -> PermissionStatus that properly returns .notDetermined, .granted, or .denied

AppState

• checkPermissions() now preserves .notDetermined state
• performStartup() auto-calls requestMicrophonePermission() when status is .notDetermined — this triggers the system prompt on first launch
• requestMicrophonePermission() opens System Settings when already .denied (re-requesting won't show the prompt again)
• Added openMicrophoneSettings() helper that opens the Microphone privacy pane directly

Settings UI

• PermissionRow now shows three states:
  • ✅ Granted (green checkmark)
  • ❓ Not Determined (orange question mark + "Grant" button)
  • ❌ Denied (red X + "Open Settings" button)
• Help text shown when any permission is denied, guiding user to System Settings

Popover

• Permission buttons adapt labels and colors based on state
• Denied mic shows "Open Microphone Settings" (red) instead of "Grant Microphone Access" (orange)
• Denied state shows specific guidance text