fix: show custom profiles in the menu bar and CLI (#28)

[sammcj]

What

FanProfile.loadAll() reads custom profiles from ~/Library/Application Support/ThermalForge/profiles, but nothing calls it. MenuBarView and watch both use FanProfile.builtIn, so a saved custom profile never appears. Second half of #28; the install self-deletion half is already fixed on main.

Behaviour change

None on a machine with no custom profile files, except one thing.

Curve.targetPercent is byte-identical to main. Tick loop, ramp governors and daemon untouched. Ordering sorts by maxRPMPercent ascending, reproducing the built-in order (0, 0.60, 0.85, 1.0); a test asserts orderedByCeiling(builtIn) == builtIn.

The exception: watch --profile smart used to throw a ValidationError because Smart isn't in builtIn. It now works.

Changes

• AppState publishes availableProfiles, read once at launch. The picker rebuilds on every status update, so it can't touch the filesystem.
• Launch restore resolves the saved id against that list, so a custom profile comes back instead of falling back to Silent.
• loadAll(from:) and save(to:) take a directory. The existing tests wrote into the real Application Support directory and deleted afterwards, destroying a user's own balanced.json.
• The profiles directory resolves through SUDO_UID when running as root, as install already does, cross-checked against the uid. Without it the root CLI reads /var/root and finds nothing.
• Profiles from disk are screened by Curve.validationError, the same way CalibrationData is screened on load. Hand-editing JSON is the only way to make one today and nothing validated it. Unreadable files are logged instead of disappearing.
• silent and smart are reserved ids because the code branches on both. A custom smart.json would have most of its curve ignored by Smart's adaptive path; a custom silent.json would show one profile in the picker while the monitor ran another.
• Ordering, so a profile quieter than Balanced doesn't sort after Max. Most separable commit if you'd rather decide ordering yourself.

Safety

The daemon speaks only RPM and knows nothing about profiles, so the 95°C override and heartbeat watchdog cover custom profiles the same as built-ins. Validation rejects curves that engage above the safety threshold or set alwaysOn, and enforces the 5°C hysteresis rule so a hand-written file can't cycle the fans on sensor noise.

Overlap with open PRs

#44 replaces this Picker with Button rows. The two changes are orthogonal: #44 changes the control, this changes what the rows are built from. Whichever lands first, the other is a small rebase, and I'm happy to do that rebase rather than make you resolve it.

Two notes

#46 proposes a settings UI covering custom curves, per-profile enable/disable and moving Smart inline, and someone has offered to prototype it. This PR doesn't prejudge that; it surfaces the JSON loadAll() already reads. If #46 lands, the ordering here is the first thing to redo.

The README sells against tools that require manual configuration, and this adds a section on hand-writing JSON. loadAll(), save() and the profiles directory are already yours; this only makes them reachable. Drop the README commit if you disagree, the code stands without it.

Testing

61 tests, swift build and swift test clean. Every filesystem test uses a UUID scratch directory under temporaryDirectory, so the suite no longer touches the real profiles directory.