feat(permission): redesign first-run grant-access screen (M3 Expressive)

The onboarding screen is the first thing a new user sees; it was a bare
centred title + body + button. Rebuild it as a proper Material 3 Expressive
welcome:

- Branded hero reconstructing the launcher mark (slate squircle + foreground
  vector); the denied state adds a lock badge over the corner
- App-name eyebrow, a benefit-led headline, and three trust rows (stays on
  device / every calendar together / no tracking) with tonal icon chips
- Full-width filled CTA with a trailing arrow, pinned in a Scaffold bottom bar
  clear of the navigation bar; scrollable body for short screens
- "Read-only · no internet permission" footnote — accurate: the app declares
  only READ_CALENDAR
- Denied/recovery state reuses the same shell with Open-settings (primary) and
  Try-again (text) actions
- 8dp spacing scale, edge-to-edge insets handled via Scaffold

Built with the newly installed material-3 skill's token/component guidance.
Resolves the pre-1.0 polish backlog item.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.planning/ROADMAP.md

@@ -50,9 +50,8 @@ All V1 features shipped, polished, on F-Droid. Read-only calendar.
 Remaining before v1.0: a UI polish/QA pass.
 
 ### Polish backlog (pre-1.0)
-- **Redesign the initial grant-access (permission) screen** — the first thing a
-  new user sees; the current rationale/permission flow needs a proper Material 3
-  Expressive pass to match the rest of the app
+- ~~Redesign the initial grant-access (permission) screen~~ — **done**
+  (Material 3 Expressive onboarding, shipped on the v0.6.0 branch)
 
 ## v2.0 — Write Support