[iLevyTate]

Fixes for the first five items of a tester's report of a Mac sorting run: files went missing, the result was unclear, and a folder on an external drive could not be added.

What changes

1. Identical files were lost (data loss)
Two byte-identical files that one run renamed or moved were each taken for a copy of the other that was already in place. Both went to the system trash, the move check failed with "destination does not exist after move", and the run was undone with the two files missing. handleDuplicateMove (src/main/utils/fileDedup.js) now ignores files the same run has still to move, and a rename inside one folder never removes the file.

2. The result of a run is stated
A run that did not move everything stays on Organize with a banner: how many files moved, how many did not and why, or that the run was undone. Identical copies that were removed are listed as duplicates with the copy that was kept, and are not counted as moved.

3. A source folder that is also a destination
A notice on Organize and a mark in Preview say which files stay where they are, or are only renamed there.

4. External and second drives
A folder outside the user folder can be a Smart Folder, can be scanned, and can have folders created in it. sanitizeFolderPath no longer bounds paths to the home tree; the destination policy decides, and asks once for a folder that is not inside a Smart Folder or Documents and was not picked in a file dialog. A refused or unreadable folder on Discover now gives the reason instead of "No files found".

Behaviour changes to review

• Security posture. Smart Folders, folder creation and folder scans now work outside the home tree. Still refused: system folders and links into them, startup folders, device paths and .. escapes. Folder scans outside the home tree run without a prompt (reads only). The stricter alternative is to prompt unless the folder is a Smart Folder or was picked in a dialog.
• Runs that did not fully succeed no longer advance to Complete. They stay on Organize with the banner.
• LINK_OUTSIDE_ALLOWED is renamed LINK_INTO_SYSTEM, and the ALLOWED_APP_PATHS export is removed. Neither has a remaining reference.
• A byte-identical file arriving where its twin landed earlier in the same run is still removed as a duplicate. It is now reported as one.

Not changed

• One file that fails the move check still undoes the whole run. Making it a per-file failure is a separate decision.
• The dashboard "failed" count covers analysis failures only, so a failed move still shows there as ready.
• The banner does not survive a restart.

Tested

Local, Windows 11 x64, on this commit's tree:

• npm run local:gate: every step passed. Jest with coverage: 955 suites, 14089 tests passed, 11 skipped, thresholds met. Production build and verify:native-modules passed.
• Playwright on a clean dev build: the eight e2e-smoke specs, 101 of 101 passed; five more setup and discover specs that use the changed folder paths, 81 of 81 passed.
• Real drive (FAT32 USB): a 38-file disposable dataset with identical pairs lost two files on main and moved all 38 on this branch. Add, scan and create-folder work on the drive. A link into C:\Windows, System Volume Information and a .. escape are refused with no prompt and nothing created.

Not verified

• macOS: no Mac was available. This includes the removable-volume permission prompt, remounts under another volume name and read-only volumes.
• A packaged build of this branch.
• Unplugging a drive while the watcher runs, and files over 4 GB on FAT32.
• Whether the tester's own files contained identical pairs.