feat(quickshell): add camera switch module

Cameras are off after every boot and get switched on per camera from the
bar. This inverts the privacy problem instead of chasing it: the previous
entry point, detecting camera *use*, cannot see raw V4L2 access at all,
and inotify on /dev/video* cannot tell a real capture from a device query.
An unauthorized camera cannot be opened in the first place.

Mechanism is `authorized` on the USB device. Measured: writing 0 drops the
/dev/videoN nodes and the PipeWire node, writing 1 brings them back and
uvcvideo rebinds itself.

A camera is identified by USB interface class 0x0e in the descriptor blob,
which stays complete while the device is deauthorized (the interface
directories do not) — so no state of our own is needed to keep a
switched-off camera listable and switchable.

The privileged helper re-derives every precondition from kernel data: id
shape, resolved path under /sys/devices, DEVTYPE=usb_device, and a video
interface class. It cannot be used to deauthorize a hub, keyboard or disk.

Switching a camera on authorizes the whole USB device, so the popout names
every other function it carries and flags in red what does not belong on a
camera. Shown rather than blocked: the internal camera carries a DFU
interface and multimedia devices commonly expose HID for their buttons, so
a class filter would lock out legitimate hardware.

Device-supplied labels are rendered as plain text and stripped of the
invisible and directional Unicode range, so a name cannot masquerade as
another device's.

A hot-plugged camera stays on — plugging one in is a deliberate act.

defaults/bin/moonarch-camera-toggle

@@ -0,0 +1,17 @@
+#!/bin/sh
+# ABOUTME: Switches one camera on or off; dispatches the privileged sysfs write via pkexec.
+# ABOUTME: Usage: moonarch-camera-toggle <usb-id> <0|1>. Exit code is pkexec's (126 = prompt cancelled).
+
+ID="${1:-}"
+VAL="${2:-}"
+
+# Shape check only — moonarch-camera-apply re-validates everything as the privileged side.
+case "$ID" in
+    ""|*[!0-9.-]*) exit 1 ;;
+esac
+case "$VAL" in
+    0 | 1) ;;
+    *) exit 1 ;;
+esac
+
+pkexec /usr/bin/moonarch-camera-apply "$ID" "$VAL"