Polish app routing picker interactions

[poulcarlsen53]

Summary

• Keep selected split-tunnel apps pinned at the top of the app picker and show a live selected count.
• Add a visible-system-app toggle plus a manual package-name field, so users can route packages like com.google.android.gms even when Android will not enumerate them in the installed-app list.
• Make split-tunnel rows a single checkbox-style control for cleaner TalkBack/touch behavior.
• Fix two profile-list papercuts: resolver drag targets now skip the default resolver row, and the selected connection profile's edit action is labeled as edit instead of "use selected".

Why

This takes a small, user-facing slice from the open app-routing/profile UX issues, especially the selected-app ordering and system-app requests in #32. I avoided adding QUERY_ALL_PACKAGES; the picker now exposes visible system apps where Android allows it and gives users a direct package-name escape hatch for packages that are hidden by package visibility rules.

Testing

• ./gradlew.bat :app:testDebugUnitTest --tests shop.whitedns.client.ui.SplitTunnelAppOptionsTest --no-daemon --stacktrace
• ./gradlew.bat :app:assembleDebug --no-daemon --stacktrace

I also tried the full :app:testDebugUnitTest :app:assembleDebug run on Windows. It still hits the existing ScanResolverChunkerTest.writePendingScanResolverFileStreamsWithoutKeepingPendingList line-ending expectation; this PR does not touch that scan writer/test path.