fix: session-create + settings edge cases (double-tap, biometric stuck, recent-dir dupes) (#133)

Four bugs from a review of session creation, the sessions list, and settings
(lower-severity than the core-path hunts — the core is now well-hardened):

1. Double-tap on the new-session FAB / 'Use this folder' created duplicate
   sessions (isCreating state lags a render). Added a synchronous re-entrancy
   ref guard.
2. 'Require biometric for messages' got stuck ON and enforced with no UI escape
   after turning off the parent 'Require biometric to open' toggle (the child
   switch is then disabled). authenticateForMessage now also gates on the parent.
3. Session-create failure on the default path silently closed the modal with no
   feedback (only the dir path alerted). Both paths now alert; message made generic.
4. Recent-directories got duplicate entries ('/x' vs '/x/') and a mismatched
   'current directory' highlight. switchDirectory/addRecentDirectory now
   stripTrailingSlash.

typecheck clean, 199 tests, i18n parity.


Claude-Session: https://claude.ai/code/session_01T12AhSnQVrSxNnvwfCx2z6

Co-authored-by: engineer <engineer@macbookpro.lan>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

src/lib/i18n/en.json

@@ -258,7 +258,7 @@
       "deleteMessage": "Delete \"{{title}}\"?",
       "deleteFailedTitle": "Delete failed",
       "deleteFailedMessage": "Could not delete the session. Please try again.",
-      "createFailedMessage": "Failed to create session in that directory."
+      "createFailedMessage": "Failed to create session. Check your connection and try again."
     },
     "empty": {
       "noConnectionTitle": "No Connection",

src/lib/i18n/zh-Hans.json

@@ -258,7 +258,7 @@
       "deleteMessage": "删除 \"{{title}}\"？",
       "deleteFailedTitle": "删除失败",
       "deleteFailedMessage": "无法删除该会话。请重试。",
-      "createFailedMessage": "无法在该目录中创建会话。"
+      "createFailedMessage": "创建会话失败。请检查网络连接后重试。"
     },
     "empty": {
       "noConnectionTitle": "无连接",