feat(ec): manage the core's shared folders from amuleGUI - #530

Closes #484.

The Directories preferences panel was inert in amuleGUI. Its tree browses the machine amuleGUI runs on — the wrong filesystem whenever the core is remote — and nothing it produced ever reached the core: the shared-folder lists aren't part of the EC preferences packet, and SaveSharedFolders() is compiled out under CLIENT_GUI. Ticking folders wrote to a list discarded at exit, while the EC_OP_SHAREDFILES_RELOAD sent alongside made the core rescan its own unchanged config — so the UI looked like it had applied the change. That was true on localhost too, not just remote.

Protocol

New EC_OP_GET_SHARED_DIRS / EC_OP_SET_SHARED_DIRS, carrying one EC_TAG_SHAREDDIR per configured root (path as the value, EC_TAG_SHAREDDIR_RECURSIVE marking a recursive one). Only the two intent lists travel; shareddir.dat stays a core-derived union. Negotiated via EC_TAG_CAN_SHAREDDIRS_CONFIG, so a new GUI against an older core leaves the editor disabled rather than pretending an edit will land.

Core

SET validates every path before applying — a remote user can't browse the core's filesystem to check one, so a typo would otherwise become a silently dead share. Valid roots are applied, persisted and rescanned; refused ones come back as EC_TAG_SHAREDDIR_REJECTED with a numeric reason the client renders in the user's own locale, so the core's locale never leaks into the UI. A rejected path doesn't discard the rest of the edit.

The union file is refreshed alongside the intent lists. ReloadSharedFolders() reconciles against shareddir.dat and drops any explicit root missing from it — that's how it honours external edits — so writing only the intent files would let the rescan trim the roots just added and persist the trimmed result.

amuleGUI

The directory tree is replaced with a Shared folder / Recursive list plus an add-row and Remove. The roots live on CPreferencesRem, which outlives the Preferences dialog, so a reply arriving after it closes repaints nothing rather than a freed dialog. The rejection report is deferred through CallAfter: a modal opened from a packet handler re-enters the EC socket and corrupts its receive state (see CAddLinkHandler).

Keeping the monolithic tree honest

Once the roots became externally editable, the monolithic tree could show stale state. TransferToWindow() already re-seeds the tree's backing maps on every open, so the model was fine — but shared marks below the root's immediate children are applied when a node is created, so anything already expanded kept the marks it was built with, and the Preferences dialog is never destroyed (OnClose vetoes).

The tree now records the roots it was painted from and rebuilds only when they've actually moved (NeedsRepaintFor), so an unchanged reopen keeps the user's expansion state and skips the drive re-scan. HasChanged is also now cleared at session end (OK/Cancel/Close) — it was only ever reset in the constructor and Init(), so a single click in the tree latched it for the dialog's lifetime.

Build layout

muuli_wdr.cpp moves from the muleappgui static library into GUI_SOURCES, so each executable compiles it with its own defines. It was previously built once without CLIENT_GUI and linked into both apps, which made every #ifdef CLIENT_GUI in it dead code. Two such branches already existed and had never taken effect — they meant to give amuleGUI plain text fields for the interface selectors, which until now silently rendered as empty combo boxes. Those now behave as intended.

Testing

Manually verified against a remote core: add/remove roots (recursive and not) persist to shareddir-explicit.dat / shareddir-recursive.dat and survive a rescan; invalid paths are reported and the valid ones still apply; the monolithic tree reflects changes made from amuleGUI. Built clean on macOS (arm64) and Ubuntu ARM64; clang-format clean across src/, Tier-1 and Tier-2 clang-tidy clean; po catalogs regenerated.