flathub: sandbox permissions (home access and secrets) via portals #1580

Part of #1060. Reviewer: "Why unrestricted home access?" and "Why unrestricted secrets access?" Linter: finish-args-home-filesystem-access (error).

Rules: "Static permissions must be kept to an absolute minimum"; apps "should rely on XDG Portals"; when a suitable portal exists, "using the portal becomes mandatory instead of static permissions"; "overly permissive configurations will not be accepted."

Current finish-args

--filesystem=home and --talk-name=org.freedesktop.secrets (plus network, ipc, x11/wayland, dri).

Work

• Files: SQLite databases, SQL scripts, export targets, theme and extension folders must come from the file chooser portal or the app's own data dirs. Drop --filesystem=home. Check .db/.sqlite file associations (opened files arrive through the portal)
• SSH tunnels: private keys and known_hosts: let the user pick key files through the chooser, or document --filesystem=~/.ssh:ro as a narrowly justified exception to ask for
• Secrets: use the Secret portal (libsecret speaks it from inside a sandbox) instead of talking to org.freedesktop.secrets directly; verify that flutter_secure_storage works and that existing entries are found
• Local MCP server / bridge: confirm what needs network and ipc
• Write a short justification for every remaining permission for the reviewer
• Add a "Running as a Flatpak" note to docs listing what changed in behaviour