Fix/cross platform stability

[sbartaula]

Summary

This PR fixes confirmed tracking, analysis, dashboard-security, installer, and cross-platform problems. It also adds automated coverage for Ubuntu, macOS, and Windows.

Major changes

• Fix cumulative duration double-counting and incorrect window attribution.
• Add non-overlapping schema-v2 activity segments while preserving legacy-log analysis.
• Correct context-switch, rapid-switching, deep-work, and focus-score calculations.
• Add native Windows foreground-window detection with a safe PowerShell fallback.
• Improve macOS window detection and cross-platform screenshot compatibility.
• Handle suspend/resume gaps, temporary detection failures, and shutdown flushing.
• Add FLOWTRACK_EXCLUDE for sensitive window/app exclusions.
• Protect local logs, screenshots, reports, tokens, and launcher files with private permissions.
• Secure the dashboard with per-user authentication, DNS-rebinding protection, Origin/content-type checks, request limits, safer filenames, and XSS fixes.
• Fix backup date scoping and clarify that GitHub secret Gists are unlisted, not private.
• Fix manual dashboard/analyzer paths on macOS and Windows.
• Improve the Ubuntu/Debian X11 installer and systemd services.
• Add accessibility, responsive-layout, and static-demo fixes.
• Add CI for Python 3.10–3.13 on Ubuntu, macOS, and Windows.

Testing

• 49/49 unit and HTTP integration tests passed in a clean virtual environment.
• pip check passed.
• Python compilation passed.
• bash -n and ShellCheck passed.
• systemd unit validation passed.
• JavaScript, JSON, SVG, and Git whitespace checks passed.
• Tracker/analyzer fuzz and invariant checks passed.

Compatibility notes

• Existing legacy logs are not modified; their incorrect cumulative durations are repaired during analysis.
• The raw dashboard URL now returns 401 without authentication. Users should open it through the private launcher or the flowtrack command.
• Linux tracking currently supports X11/Xorg only. Wayland remains unsupported.
• macOS and Windows behavior is covered by automated mocked integration tests, but foreground-window and screenshot permissions still require a real graphical-session smoke test.