Finish the reskin: tray parity, friendly picker labels, guarded macOS font, docs sweep

[chrisuthe]

Phase 6 of the reskin, the last. Closes the loose ends the earlier phases left and sweeps the docs so they describe the app as it is.

What changed

• Tray menu at parity with Sendspin for Windows. Under the existing status line: Play/Pause, Next, Previous, Switch Group, separator, Mute/Unmute, a disabled Volume: NN % readout, separator, Show Sendspin Player, Quit. Switch Group is there regardless of the footer setting. The transport items bind the view model's commands, so they grey out together while disconnected (NativeMenuItem follows CanExecute, and every exporter's click path executes the command). Mute goes through a new ToggleMuteCommand so the footer button and the tray drive the one property. State stays in labels, never IsChecked (Avalonia #8751). TrayMenuTests builds the menu over the headless platform's null tray and reads the headers, the enable state, mute and the readout.
• Friendly labels for Connection mode and Auto-connect, on the BackdropModeLabel pattern: the picker still writes the enum through; only the item template goes through the converter. SettingLabelTests pins every member of both enums; ConnectionMode.Auto is obsolete on this SDK line and is the one member allowed to fall through, and the test says so.
• macOS system font, shipped and guarded. ReadDesktopFontFamily names .AppleSystemUIFont only after SKFontManager.Default.MatchFamily returns a typeface for it, and leaves the name null (with a line on stderr) otherwise, because an unresolvable DefaultFamilyName kills the process before a window appears. The rule is Core/Platform/MacSystemFont.Select over a resolver, pinned by MacSystemFontTests without a Mac. Program.cs and ARCHITECTURE now say "shipped, guarded".
• Comment sweep. Every "Phase N" / temporary-home comment under src/Sendspin.Player now says what the code is for; the grep in the brief returns nothing.
• Docs. README gains the living backdrop, Stats for Nerds and the settings card in "What it does", the fuller tray bullet, and a Screenshots section with four images. NEXT_STEPS records the native shell, the UiClock rule and the advertised backdrop roles as done-and-closed. ARCHITECTURE gains an index at the top of the UI shell section and a phase 6 "As shipped" paragraph. COMPLIANCE was checked and is unchanged: the controller@v1 row already lists mute and switch.

Decisions worth a look

• The status line stays as the first menu item. The brief lists the reference's items to add; the status line is this app's own and nothing in the reference replaces it, so it is kept rather than dropped, and the tooltip is left as it was.

Verification

• make test green: 341 + 172 tests. dotnet format clean on every project touched. Release build with warnings-as-errors and EnforceCodeStyleInBuild clean on every Linux-buildable project. Hygiene tests pass and EverySettingsComboBoxIsGuarded still counts five.
• The macOS head cannot be built on Linux. PlatformSelection.MacOS.cs was compile-checked with csc against the real SkiaSharp, Avalonia and Core assemblies with nullable and warnings-as-errors.
• The one unverified item: on the Mac, launch the app and read the start-up UI font: log line. $Default is .AppleSystemUIFont, glyphs from System Font means the guard passed and the system face is in use; $Default is Helvetica plus a .AppleSystemUIFont does not resolve here line on stderr means it declined safely.