fix: restore cross-app hotkey via HID tap + active tap options

[quiet-node]

Summary

• Fixes the double-tap Control hotkey silently stopping after switching focus to any other app
• Root cause was two independent CGEventTap configuration mistakes in activator.rs, both required to fix

What broke and why

CGEventTapLocation::Session (was the main culprit)
Session-level taps sit above the macOS window server routing layer. Since macOS 15 Sequoia, the window server applies focus-based filtering: a Session-level tap only receives events while the tap's own process has focus. Switching to any other app produces zero callbacks with no errors. Fixed by switching to CGEventTapLocation::HID, which operates before the window server layer and receives all events regardless of focus — the same approach used by Karabiner-Elements and BetterTouchTool.

CGEventTapOptions::ListenOnly (secondary issue)
ListenOnly taps are killed by macOS secure input mode. When iTerm's "Secure Keyboard Entry" is enabled (or any password field is focused), macOS sends TapDisabledByUserInput and stops all event delivery. Fixed by switching to CGEventTapOptions::Default. We still return CallbackResult::Keep in the callback so no events are blocked.

Other changes

• Added TapExitReason enum to distinguish intentional stop, creation failure, and macOS-disabled tap — enabling correct retry behavior
• Rewrote run_loop_with_retry to loop while active, retry immediately on TapDied, back off on CreationFailed
• Added TapDisabledByTimeout / TapDisabledByUserInput handling in callback (these sentinel values cannot be in the event mask bitmask — causes a shift-left overflow panic)
• Added Input Monitoring permission check/request via IOKit FFI (IOHIDCheckAccess / IOHIDRequestAccess)
• Added Input Monitoring as a third step in the onboarding flow
• Updated CLAUDE.md with a "DO NOT CHANGE" warning documenting both required tap settings

Test plan

• Double-tap Control summons/dismisses the overlay while Thuki has focus
• Double-tap Control summons/dismisses the overlay after switching focus to another app (Safari, Finder, etc.)
• Double-tap Control works with iTerm "Secure Keyboard Entry" enabled
• Onboarding flow shows all three permission steps in order (Accessibility, Input Monitoring, Screen Recording)
• bun run test:all passes with 100% coverage
• bun run validate-build completes with zero warnings and zero errors

🤖 Generated with Claude Code

[quiet-node]

Code review

Found 1 issue:

1. The doc comment on is_input_monitoring_granted says the permission is required for "a CGEventTap at Session level" — but this PR's central change is switching the tap away from Session to HID level. The comment describes the old, broken behavior and directly contradicts the "DO NOT CHANGE" guidance added to CLAUDE.md in this same PR.

thuki/src-tauri/src/permissions.rs

Lines 66 to 72 in 1b21c1e

	///
	/// Input Monitoring (`kTCCServiceListenEvent`) is required for a CGEventTap at
	/// Session level to receive keyboard events from other applications. Without it,
	/// the tap only sees events generated within the Thuki process itself, making
	/// the double-tap hotkey invisible when the user's focus is elsewhere.
	///
	/// Unlike Screen Recording, Input Monitoring does not require a process restart

The comment should say HID level, not Session level (or omit the tap-level qualification entirely, since the function is not tap-level-specific).

🤖 Generated with Claude Code

_{If this code review was useful, please react with 👍. Otherwise, react with 👎.}