Add responsive transfer queues and storage diagnostics

[nsoliven]

What changed

• keeps file selection responsive while transfers run and persists immutable FIFO event batches so more work can be queued safely
• rebuilt the Transfer Queue as a compact, resizable macOS utility window with per-file progress, speed, verification, and clear waiting/failure states
• made Transfers, Speed Tests, Events, the Photo Database, and Keyboard Shortcuts discoverable from the sidebar
• added live whole-unit storage meters, read-only camera/card benchmarks, temporary-file destination benchmarks, and negotiated USB bottleneck guidance
• added confirmation-gated Free Up Camera after full checksum verification
• completed Finder-style context menus, inline folder trees, keyboard navigation, Copy Path, guarded empty-folder deletion, and 16-point thumbnails
• added Finder-style Move to Trash for files, non-empty folders, and multi-selection, available from right-click and ⌘Delete
• clarified import, Buffer, and permanent-originals roles in Settings
• made Settings and every utility/preview pop-out freely resizable with safe minimum sizes
• added secure, read-only TrueNAS capacity integration for the exact dataset and underlying pool

Root cause and behavior

The browser previously watched one global busy flag and reloaded whenever any background job finished. That intersected or cleared selection, while transfer completion could erase paths added during the running copy. Transfers now capture independent, persistent per-event batches, deduplicate active/queued paths, run FIFO, and do not own browser selection state.

macOS also returned a synthetic SMB filesystem value that looked like completely empty capacity. The sidebar now labels that result SMB estimate and uses an amber state instead of claiming it is exact. When a TrueNAS API key is configured, Camera Toolkit resolves the mounted SMB share to its backing ZFS dataset, reads dataset used/available and pool total/free/health, and applies the result only to locations on that specific mounted volume. The row then shows dataset free space plus pool size and its help text includes both dataset and pool details.

The TrueNAS client uses the versioned secure JSON-RPC WebSocket API. API keys stay in macOS Keychain. Self-signed certificates can be explicitly pinned by SHA-256 fingerprint, and later certificate changes are rejected. No NAS endpoint, dataset, username, certificate, or key is committed.

Folder disclosure reads only the directory being expanded, runs outside the UI actor, and displays per-row loading/retry state. Storage reads and transfer work also remain off the main actor.

Safety

Copy and queue actions never delete source files. Free Up Camera appears only after every queued item is verified, shows exact count and size, requires typing REMOVE, and performs a fresh streaming SHA-256 comparison before removing any source file. One missing or changed file aborts the whole removal.

Move to Trash always confirms, uses macOS Trash rather than recursive deletion, validates every target before moving the first one, collapses parent-and-child selections safely, refuses configured locations and drive roots, refreshes the browser and storage state, and reports any partial failure honestly.

Empty-folder deletion uses the OS atomic empty-directory operation, refuses visible or hidden contents and symbolic links, and protects configured locations, ancestors, filesystem roots, and mounted-volume roots.

Validation

• swift test — 126 tests passed
• git diff --check
• scripts/audit-public-repo.sh
• release packaged, ad-hoc signed, and installed at /Applications/CameraToolkit.app
• visually verified the installed sidebar uses whole-unit local values and amber SMB estimate labels for the mounted library
• live-verified the installed right-click menu exposes Move to Trash and Delete Empty Folder together
• live-verified ⌘Delete opens the same path-specific confirmation and Escape cancels without removing test media
• verified the real NAS endpoint and current TLS certificate are saved only in local app configuration
• verified automatic mounted-volume matching, deepest-dataset selection, exact capacity parsing, migration defaults, Finder actions, transfer persistence, cleanup safety, bounded preview memory, and resizable windows in tests
• opened and visually audited the installed main window and Settings surface

Exact live TrueNAS capacity intentionally remains unavailable until a read-only API key is saved locally; the app does not invent a number or commit a credential.