feat: permission tiers + memory action layer (v0.2.0)

Adds a capability tier model (User / Full Disk Access / Admin /
Accessibility / Automation) so cleanup rules and memory actions can
declare what TCC surface they need. Probes run at startup without
triggering prompts; the new Permissions tab (key 5) shows status and
deep-links to System Settings.

New memory actions on the System tab:
  P  purge inactive memory (admin)
  F  flush DNS cache (admin)
  S  suspend selected process (SIGSTOP)
  R  resume selected process (SIGCONT)

Admin-tier deletions go through one batched osascript prompt per
cleanup run instead of one per file. APFS local snapshots are listed
via tmutil and removed by date.

New cleanup rules:
  - Mail (envelope index / downloads / attachments) — FDA
  - Messages attachments — FDA
  - Photos derivative caches — FDA
  - iOS backups + Xcode iOS DeviceSupport — FDA
  - Simulator caches, Homebrew cache, QuickLook + font caches — User
  - /Library/Caches, /private/var/log, DiagnosticReports,
    APFS local snapshots — Admin

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: akhil-gautam

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "bloat"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2021"
 description = "An htop-style disk storage analyzer and cleanup TUI for macOS"
 
@@ -21,6 +21,9 @@ sysinfo = "0.33"
 notify-rust = "4"
 toml = "0.8"
 mlua = { version = "0.10", features = ["lua54", "vendored"] }
+glob = "0.3"
+rusqlite = { version = "0.32", features = ["bundled"] }
+core-foundation = "0.10"
 
 [dev-dependencies]
 tempfile = "3"

Cargo.toml

@@ -0,0 +1,17 @@
+# APFS local snapshots inventory — read-only, no admin needed.
+# Use the System Caches admin rule (in the Cleanup tab) to actually
+# delete snapshots; this panel only reports what's there.
+
+[[panel]]
+name = "APFS Snapshots"
+command = "tmutil listlocalsnapshots / 2>/dev/null | wc -l | awk '{print $1\" snapshots\"}'"
+interval = 30
+position = "right"
+color = "magenta"
+
+[[panel]]
+name = "Simulators (stale)"
+command = "xcrun simctl list devices 2>/dev/null | grep -c unavailable || echo 0"
+interval = 60
+position = "right"
+color = "blue"

examples/plugins/apfs-snapshots.toml

@@ -0,0 +1,10 @@
+# Brew cleanup status panel — shows reclaimable Homebrew bytes.
+# Copy alongside your existing plugins.toml (`brew cleanup --dry-run`
+# does not modify state, so this is safe to poll).
+
+[[panel]]
+name = "Brew Cleanup"
+command = "brew cleanup --dry-run 2>/dev/null | tail -3"
+interval = 60
+position = "left"
+color = "yellow"