feat(permission): redesign first-run grant-access screen (M3 Expressive)

The onboarding screen is the first thing a new user sees; it was a bare
centred title + body + button. Rebuild it as a proper Material 3 Expressive
welcome:

- Branded hero reconstructing the launcher mark (slate squircle + foreground
  vector); the denied state adds a lock badge over the corner
- App-name eyebrow, a benefit-led headline, and three trust rows (stays on
  device / every calendar together / no tracking) with tonal icon chips
- Full-width filled CTA with a trailing arrow, pinned in a Scaffold bottom bar
  clear of the navigation bar; scrollable body for short screens
- "Read-only · no internet permission" footnote — accurate: the app declares
  only READ_CALENDAR
- Denied/recovery state reuses the same shell with Open-settings (primary) and
  Try-again (text) actions
- 8dp spacing scale, edge-to-edge insets handled via Scaffold

Built with the newly installed material-3 skill's token/component guidance.
Resolves the pre-1.0 polish backlog item.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Redesigned the first-run grant-access screen — the onboarding a new user
+  sees. Material 3 Expressive layout: branded launcher-mark hero, an
+  app-name eyebrow, a benefit-led headline, three trust rows (on-device,
+  every calendar, no tracking) with tonal icon chips, a full-width filled CTA
+  with a trailing arrow, and a "Read-only · no internet permission" footnote
+  (the app declares only `READ_CALENDAR`). The denied/recovery state shares the
+  same shell with a lock-badged hero and Open-settings / Try-again actions
+
 ## [0.6.0] — 2026-06-11
 
 ### Added