Bring Ask Key back after Touch ID even when another app took focus

[sudoHG]

Refs #127

Problem

On the maintainer's Mac, with Orca behind Ask Key, unlocking management left Ask Key under Orca. A frontmost-app trace (lsappinfo front, read-only) during the unlock:

请旨 (app) -> 请旨 (authentication process) -> coreautha -> Orca

The Touch ID sheet belongs to the system's coreautha, not to the authentication process. When it closes, macOS activates the next app (Orca). The app then asked to come back with the cooperative activate(), which macOS refuses when nobody yields; and the "did the user switch away" check from #157 looked at the authentication process, which is never in front, so it skipped even that request.

Change

• Remove the unreliable "user switched away" check.
• When Ask Key was in front before the prompt, it activates itself with activate(ignoringOtherApps: true) after authentication (the same call that already gives the prompt its focus), and asks again after 0.25 s and 0.75 s if the system handed focus elsewhere while the sheet was closing.
• Approvals answered from another app are unchanged: Ask Key was not in front, so it does not take focus.

Tests

The focus decisions are now injectable (ManagementAuthenticationFocus), and ManagementAuthenticationFocusTests checks them with a stub prompt process:

• App in front: yields to the prompt, activates after it ends, and asks again when another app took focus meanwhile.
• App in front and back after the first activation: no repeated activation.
• Approval answered from another app: no yield, no activation.
• The prompt end is announced so the Dock state is reconciled.

Real activation still needs the maintainer's Mac; the frontmost-app trace is part of the pre-release checks.

Checks

• swift build: passed.
• swift test --filter ManagementAuthentication: 28 passed, 0 failed (4 new; the new suite passed 3 runs in a row).
• Verified on the maintainer's Mac with the same frontmost-app trace before notarizing.
• Full suite and desktop flows: this PR's CI.