Keep Nemo responsive with independent file-data limits

[ClaudiuSchuster]

What changed

• add independent logarithmic upload and download file-data limits to the
  Control Center and its CLI/state contract
• add a first-run connection-headroom step with disclosed bounded auto-tuning,
  manual expert controls and an unlimited option
• move live limiting from rclone's global transport bucket to a Proton backend
  runtime command so directory listings and authentication remain responsive
  during a throttled bulk upload
• install a checksum-pinned, source-published rclone build containing the
  backend limiter and source-pinned API-bridge worker-drain fix
• apply saved limits after mount startup so backend options cannot change the
  VFS cache fingerprint or hide an existing Dirty queue namespace
• add a privacy-safe setup-wizard screenshot and update the user, operator,
  troubleshooting and developer documentation

Fixes #12
Fixes #15

Safety impact

• Credentials: unchanged; auto-tune sends no Proton credentials and stores only
  local rates/timestamps in a mode-0600 file.
• RC socket: remains the existing owner-only Unix socket; no TCP listener or
  broader command surface is introduced.
• Active transfers: runtime changes do not restart rclone or close an active
  transfer. The live development install retained the same PID during install.
• Dirty VFS data: never deleted, moved or rewritten. Runtime application kept
  the existing Proton cache fingerprint and the exact pending queue visible.
• Metadata consistency: Proton metadata caching rules are unchanged. The new
  limiter deliberately excludes metadata/API requests from bulk payload limits.
• Service restarts: none are performed by the installer or updater. One
  controlled development restart was used before this commit to validate the
  source-pinned binary and preserved cache namespace.
• Privileged setup: unchanged; only fixed system executables remain eligible
  for the existing Polkit path. The rclone asset is downloaded and verified as
  the unprivileged user.

Verification

• make verify
• Behavior-specific regression coverage covers runtime/startup limits,
  separate directions, state export, auto-tune, checksum rejection,
  updater behavior and first-run navigation.
• UI changes were exercised in English and German, at minimum width and in
  idle/active fixtures through isolated Broadway GTK suites.
• No real credentials, tokens, private paths or personal filenames appear
  in code, fixtures, logs or screenshots.
• No active transfer was interrupted and no Dirty cache data was deleted.
• User-facing documentation is updated; version metadata intentionally
  remains unchanged until post-merge user acceptance for the next release.
• Super-Linter 8.7.0 passed Bash, Actions/Zizmor, Gitleaks, Markdown and
  Prettier, Ruff lint/format, XML and YAML validators.
• The source-pinned rclone backend passed package tests, the Go race
  detector and a full build; the API-bridge worker fix passed its race suite.