gui: real RTL + no-download-logic checks; split into velox-gui-lib

Follow-up hardening after a review noted the RTL "check" verified nothing
(a .ts stub that no test loads), matching a session-wide pattern of
checks written against what should be true rather than what would break.

- Split the non-main() code into velox-gui-lib (STATIC) so tests link the
  real widgets/models, not a reimplementation.
- tst_rtl: builds the real MainWindow, flips layoutDirection, asserts the
  direction propagates to the central widget AND that the offline-banner
  QHBoxLayout actually mirrors (label x-position LTR vs RTL differs by
  >100px). Verified it fails when the banner is pinned LtR.
- gui_no_download_logic: a ctest that greps gui/src for curl_*/pwrite/
  sqlite/QSqlDatabase/QNetworkAccessManager and fails on a hit — CLAUDE.md
  §3 as an executable check. Verified it fails when a curl_ token is added.
- Still uncovered (noted, not claimed): that the translation catalogue
  loads and the right context/strings resolve at runtime.

Not covered here because the files are PKG/QA-owned: tools/bootstrap.sh
ships a package name that does not exist on 26.04 (libqt6svg6-dev; the
real one is qt6-svg-dev), and --check validates pkg-config outcomes
rather than the apt names it would install. Both, plus the same name in
AGENT-PKG-QA.md and the README, are written up apply-ready in
gui/docs/pkg-qa-requests-m1.md.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_016Ne28kx4VreeBWZv82Nksd

gui/tests/no_download_logic.cmake

@@ -0,0 +1,39 @@
+# Fails if any download-logic token appears under gui/src. Run as a ctest (see
+# tests/CMakeLists.txt). CLAUDE.md §3: "A grep for curl|pwrite|sqlite in gui/ must come
+# back empty."
+#
+# Invoked with -DGUI_SRC=<abs path to gui/src>.
+
+if(NOT DEFINED GUI_SRC)
+    message(FATAL_ERROR "GUI_SRC not set")
+endif()
+
+file(GLOB_RECURSE sources "${GUI_SRC}/*.cpp" "${GUI_SRC}/*.hpp")
+
+# Word-ish boundaries so this file's own prose and e.g. "curly" do not trip it, and so a
+# comment mentioning the rule is fine but a real call is not.
+set(forbidden
+    "curl_[a-z_]+"          # libcurl
+    "\\bpwrite\\b"          # raw positioned writes — the transfer path, not the GUI
+    "sqlite3?_[a-z_]+"      # sqlite C API
+    "QSqlDatabase"          # or via Qt
+    "QNetworkAccessManager" # the GUI talks to the daemon over QLocalSocket, nothing else
+)
+
+set(hits "")
+foreach(file ${sources})
+    file(STRINGS "${file}" matched REGEX "(curl_[a-z_]+|\\bpwrite\\b|sqlite3?_[a-z_]+|QSqlDatabase|QNetworkAccessManager)")
+    foreach(line ${matched})
+        string(STRIP "${line}" line)
+        list(APPEND hits "${file}: ${line}")
+    endforeach()
+endforeach()
+
+list(LENGTH hits n)
+if(n GREATER 0)
+    string(REPLACE ";" "\n  " pretty "${hits}")
+    message(FATAL_ERROR
+        "download-logic token(s) found under gui/src — CLAUDE.md §3:\n  ${pretty}")
+endif()
+
+message(STATUS "gui/src is clean of download-logic tokens (${forbidden})")