Check protected-file access before macOS startup guidance

Run a conservative, read-only preflight off the UI thread before offering Full Disk Access setup. Successful or inconclusive checks stay silent; only a protected-access denial offers guidance. Honor the native reminder opt-out locally and expose manual settings access in the macOS app menu.

app/src/lib.rs

@@ -61,6 +61,7 @@ mod experiments;
 mod external_secrets;
 #[cfg(target_family = "wasm")]
 mod font_fallback;
+mod full_disk_access;
 pub mod galaxy_managed_paths_watcher;
 pub use galaxy_managed_paths_watcher as warp_managed_paths_watcher;
 mod global_resource_handles;
@@ -2826,6 +2827,10 @@ fn launch(ctx: &mut galaxyui::AppContext, app_state: Option<AppState>, launch_mo
                 timer.mark_interval_end("WINDOWS_CREATED");
             });
 
+            if cfg!(target_os = "macos") && matches!(launch_mode, LaunchMode::App { .. }) {
+                full_disk_access::prompt_on_startup(ctx);
+            }
+
             #[cfg(feature = "local_fs")]
             if matches!(launch_mode, LaunchMode::App { .. })
                 && PersistenceWriter::as_ref(ctx).sender().is_none()