feat: add PowerStation API v0.2 fan profiles

[sknowledge1]

Fan controls now use PowerStation's complete profile API v0.2, including the startup contract in PowerStation #54. Hardware matching, required safety sensors, native curve constraints and thermal policy stay in the service.

Behavior

• Replace preset/per-fan mutators with LoadProfile, LoadProfileJson, fan/sensor discovery, current profile name/path and advertised modes.
• Show 0–100% duty only when valid, independently of sensor telemetry. Remove RPM, raw PWM, ownership and controller-policy controls.
• Edit complete named JSON profiles or load an approved-directory YAML file such as quiet.yaml. A profile includes every fan once; native point counts are validated by the service without resampling. Draft edits do not write hardware.
• Keep Firmware Automatic callable without valid telemetry or a valid draft.
• Save confirmed selections in bounded private application preferences using synced atomic writes. File selections preserve a reference to the current packaged/distro profile. Corrupt existing preferences are preserved and reported.
• Restore once on a proven first managed invocation: pin the unique bus owner, compare the kernel boot identity and consume the per-user attempt before reading preferences or sending a native guarded startup load. Faults, restarts, changed ownership, another selection, invalid input and uncertain results never trigger replay. Menu refresh/remount does not restore profiles. Native suspend/resume retains the live profile.

The fan documentation describes the modes, a concise profile example, persistence and recovery. This replaces API v1 directly. The separate Decky migration is complete; this native client remains independent of its release.

Local validation

Exact candidate: 17c1610952530e9705d4e577ad5e3753f7794fb6, based on main 0db5812f21e98d0a5ac70bb1b5a674f2f369c22c with two linear contribution commits. Pinned builder: Rust 1.97.1 / Godot 4.7.1.

• Formatting and locked Rust tests: 8 pass, including real private-D-Bus version/owner/error/restore cases and preference failure paths.
• Focused Godot/GUT: 14 tests / 57 assertions pass, no skips or SCRIPT ERROR.
• Actual Godot-to-native integration: 32 assertions pass against PowerStation fffb4b93979dd2622cd93cfa097baacc27b7a2e6 on private D-Bus and fake sysfs, including both saved JSON and file startup restoration.
• Clippy completes with the same 13 diagnostics reproduced on untouched main; no suppressions are added.
• Locked x86_64/aarch64 release builds and both Godot exports pass. Both packs contain the runtime model/panel and exclude tests/GUT fixtures; ELF architectures and artifact hashes are recorded locally.
• Cargo.lock changes only to promote already-locked serde_json 1.0.149; no locked dependency version changes.

The broader network-isolated headless suite retains the GitHub-release assertion failure and thread-pool/OSK script errors reproduced on untouched main; it is not a clean full-suite pass. GitHub reports no test check contexts for this new head at this update. Counts above are local validation.

Native GUI/device acceptance on these revised heads, thermal-policy acceptance, official packages/images and ARM dependency/install qualification remain separate release gates. No device runtime or release was changed by this source revision.

Assisted-by: Codex