App exclusion / sensitivity controls to prevent capture of sensitive apps

[sunnypatneedi]

Problem

Users have no way to prevent Familiar from capturing specific apps (e.g. password managers, banking apps, private terminals). Every app in focus gets captured regardless of sensitivity.

Solution

Add an excludedBundleIds setting (array of macOS bundle IDs). The recorder checks the frontmost app's bundle ID before writing any file — so excluded apps produce zero disk I/O.

Details

• excludedBundleIds: string[] persisted in ~/.familiar/settings.json
• deduplication: { enabled: boolean, threshold: number } also added to settings
• updateExcludedApps(bundleIds) method on recorder for live updates without restart
• Exclusion check runs after metadata fetch, before renderer write (no unlink race)

Acceptance criteria

• excludedBundleIds and deduplication fields handled in settings.js
• Recorder skips file write entirely for excluded bundle IDs
• updateExcludedApps() updates exclusion set at runtime
• Tests pass