fix(ui): macOS title bar — restart-to-apply toggle, hide-completely row hidden

PR #569 follow-through with the owner-corrected scope: on macOS BOTH
titlebar modes work (native bar, or traffic lights integrated in the
QBZ header) — what's broken is hot-applying the toggle: the overlay
window attributes are fixed at creation, but the .slint chrome
(no-frame, header drag+inset, Purchases placement) flipped reactively,
hiding the buttons one way and overlapping them the other.

Split pref from applied state: the toggle edits use-system-title-bar
(persisted), the chrome reads a new system-title-bar-active seeded at
startup; the handler mirrors pref->active live on Linux only (behavior
byte-identical there), macOS keeps the session value + the existing
restart toast. The hide-title-bar row is macOS-hidden (that part of
the PR was right); the system-bar toggle stays.

cc

crates/qbz-ui/ui/state.slint

@@ -3002,6 +3002,14 @@ export global AppearanceState {
     // macOS = overlay (native traffic lights over the header). The .slint
     // default is the safe Linux one.
     in-out property <bool> use-system-title-bar: true;
+    // APPLIED chrome state (what the window was actually created with, vs the
+    // persisted pref above which the settings toggle edits). All chrome
+    // bindings (no-frame, header drag/inset/controls, Purchases placement)
+    // read THIS one. Rust decides per platform how the pref propagates:
+    // Linux mirrors the pref here live (hot apply, today's behavior); macOS
+    // leaves it at the startup value (the overlay attributes are fixed at
+    // window creation — restart to apply).
+    in-out property <bool> system-title-bar-active: true;
     // Tiling-WM variant: frameless without drawn controls / header drag.
     in-out property <bool> hide-title-bar: false;
     // Phase 2 (deferred): rounded corners matching the desktop decoration.