refactor: two-screen app-list editor with native List layout

Screen 1 is a plain List (name field, the apps the list contains via
FamilyControls token Labels, and an Edit Apps button); screen 2 pushes
Apple's FamilyActivityPicker whose Save applies the selection back.
Documents that the picker silently drops selections without real
FamilyControls authorization (mocked in -ui-testing launches).

docs/RULES_FEATURE_SPEC.md

@@ -76,6 +76,17 @@ Dark theme throughout (near-black background, very dark green tint).
    icons. Each icon has a lock badge overlay and a teal/green rounded-rect
    outline; caption "Unblock" under the icon. Tapping unblocks (with friction
    if hard mode — not demoed).
+   *(OpenAppLock)* Time/Open Limit rules whose budget is spent for the day
+   also appear here, blocked until midnight.
+3. **Usage** *(OpenAppLock addition — not in the Opal video)* — a section
+   directly below Blocked Apps showing live tracking for every enabled
+   Time/Open Limit rule scheduled today:
+   - Time Limit row: subtitle "18m of 45m used today", trailing "27m left";
+     when spent: "Blocked until tomorrow" (red).
+   - Open Limit row: subtitle "2 of 5 opens today", trailing "3 opens left";
+     when spent: "Blocked until tomorrow" (red).
+   Usage numbers come from the shared app-group ledger written by the
+   DeviceActivity monitor and shield-action extensions.
 3. **Rules** — header row: "Rules ›" (leading, tappable to a full list,
    presumably) and "**+ New**" (trailing, green tint) which opens the New Rule
    sheet.
@@ -257,6 +268,15 @@ Full-height sheet:
 4. **Time-limit rules** — accumulate usage daily across the selected apps;
    on crossing the threshold, shield until the `Until` reset point
    (e.g. tomorrow), then reset the budget.
+   *(OpenAppLock specifics)*: usage lives in a per-rule, per-day **usage
+   ledger** in the app group. A limit rule's derived status becomes
+   `active(until: next midnight)` once the ledger reports the budget spent on
+   an enabled day — it then surfaces in Blocked Apps, Hard Mode gating
+   applies, and a soft unblock pauses it until midnight. Open-limit rules
+   work the same with an opens budget; while opens remain, their apps stay
+   shielded with an "Open" button on the shield (each press spends one open
+   and lifts the shield for up to 15 minutes — the DeviceActivity minimum
+   interval).
 5. **Disable vs delete** — "Disable Rule" pauses scheduling but keeps the
    rule (card presumably shows disabled state). No delete flow was shown;
    add delete via swipe/long-press or a button in the editor.