fix: remove Input Monitoring and suppress native permission popups

[quiet-node]

Summary

• Remove the Input Monitoring permission requirement from onboarding, simplifying the flow from 3 steps to 2 (Accessibility + Screen Recording). The CGEventTap at HID level receives cross-app keyboard events without needing a separate TCC entry.
• Defer CGEventTap creation until Accessibility is already granted, preventing macOS from showing the native "Thuki would like to control your computer" popup during onboarding. The activator starts cleanly on the post-Screen Recording quit+reopen when both permissions are guaranteed.

Test plan

• Fresh launch shows onboarding with no native Accessibility popup
• Granting Accessibility in System Settings advances to Screen Recording step
• Clicking "Open Screen Recording Settings" still shows the native Screen Recording popup (expected, needed to register Thuki in TCC)
• After quit+reopen, hotkey (double-tap Control) works across all apps
• Permission revocation triggers onboarding again on next launch

🤖 Generated with Claude Code

[quiet-node]

Code review

Found 1 issue:

1. Em dashes introduced in PermissionsStep.tsx (global CLAUDE.md says "Never use em dashes (---) in any output: code comments, documentation, markdown files, commit messages, or prose. Use a contextually appropriate alternative instead: a colon, comma, semicolon, or period.")

Two em dashes were introduced on lines 149 and 298:

thuki/src/view/onboarding/PermissionsStep.tsx

Lines 148 to 150 in c41bf47

	*
	* Visual direction: Warm Ambient — dark base with a warm orange radial glow.
	* The outer container is transparent so the rounded panel corners are visible

thuki/src/view/onboarding/PermissionsStep.tsx

Lines 297 to 299 in c41bf47

	{/* Logo mark + title — drag region so the user can reposition the
	onboarding window when it overlaps System Settings. */}

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}