fix(gui): add non-Linux stubs for pmkid_hunt/pmf_test and fix Windows warnings

main.rs failed to compile on Windows: pmkid_hunt and pmf_test were only
implemented under #[cfg(target_os = "linux")], with no fallback stub,
so the Tauri commands calling them did not resolve.

- Add #[cfg(not(target_os = "linux"))] stubs for both, matching the
  existing pattern for every other Linux-only Engine method (returns
  SabiaError::UnsupportedPlatform).
- Mark the DeauthJob/Engine fields and session_ap/client_snapshot
  helpers that only the Linux-only code paths use with
  #[cfg_attr(not(target_os = "linux"), allow(dead_code))], same for
  eviltwin.rs's form_value/url_decode (only called from the
  #[cfg(target_os = "linux")] HTTP handler) — silences the 5
  dead_code warnings a Windows build produced.
- .setup(|app| ...) used app only inside unix/linux/macos-gated
  blocks, so it was unused on Windows; renamed the closure parameter
  and reintroduce it under the matching cfg.
- Add the missing English dictionary entry for the mutation-rules
  checkbox label in app.js (found by visually reviewing a generated
  screenshot: it was rendering in Portuguese in the English UI even
  though check-ui-i18n.mjs reported full coverage).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

apps/gui/src-tauri/src/main.rs

@@ -1,4 +1,4 @@
-// Evita a janela de console extra no Windows em release.
+// Prevents an extra console window on Windows in release builds.
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
 
 use sabia_core::engine::{Engine, ScanOptions};
@@ -506,9 +506,9 @@ fn update_apply(state: tauri::State<'_, State>) -> Result<String, String> {
     state.0.update_apply().map_err(|e| e.to_string())
 }
 
-/// `true` quando o processo já tem privilégio suficiente pra tudo que o
-/// Sabiá faz (modo monitor, captura crua). No Windows o manifesto já
-/// exige administrador antes mesmo do app abrir, então aqui é sempre `true`.
+/// `true` when the process already has sufficient privileges for all
+/// Sabiá operations (monitor mode, raw capture). On Windows the manifest already
+/// requires administrator privileges before launch, so this is always `true`.
 #[tauri::command]
 fn is_elevated() -> bool {
     #[cfg(unix)]
@@ -521,9 +521,9 @@ fn is_elevated() -> bool {
     }
 }
 
-/// Reabre o app com privilégios de administrador (Linux/macOS). O app novo
-/// encerra este quando abre; se a autorização falhar ou for cancelada, a
-/// janela continua aqui e a interface mostra o motivo.
+/// Relaunches the app with administrator privileges (Linux/macOS). The new instance
+/// terminates this one on startup; if authorization fails or is cancelled, the
+/// window stays open and the UI displays the reason.
 #[tauri::command]
 fn relaunch_elevated(app: tauri::AppHandle) -> Result<(), String> {
     #[cfg(any(target_os = "linux", target_os = "macos"))]
@@ -610,9 +610,9 @@ fn do_relaunch_elevated(app: tauri::AppHandle) -> Result<(), String> {
     Ok(())
 }
 
-/// Caminho que o root consegue executar. No AppImage, `current_exe` aponta
-/// pra dentro de um ponto de montagem FUSE do usuário, inacessível ao root:
-/// usa o próprio arquivo `.AppImage` (variável `APPIMAGE`).
+/// Executable path accessible to root. Inside an AppImage, `current_exe` points
+/// inside a user FUSE mount that root cannot access:
+/// use the `.AppImage` file itself (`APPIMAGE` environment variable).
 #[cfg(any(target_os = "linux", target_os = "macos"))]
 fn elevated_exe() -> Result<std::path::PathBuf, String> {
     if let Some(p) = std::env::var_os("APPIMAGE")
@@ -628,8 +628,11 @@ fn main() {
     let engine = Arc::new(Engine::new());
     tauri::Builder::default()
         .manage(State(engine))
-        .setup(|app| {
-            // Quando abrimos elevados a pedido do app normal, ele fecha o app antigo.
+        .setup(|_app| {
+            #[cfg(any(target_os = "linux", target_os = "macos"))]
+            let app = _app;
+
+            // When launched elevated by the unprivileged instance, terminate the old process.
             #[cfg(unix)]
             if let Some(pid) = std::env::var("SABIA_REPLACE_PID")
                 .ok()
@@ -637,7 +640,7 @@ fn main() {
             {
                 std::thread::spawn(move || {
                     std::thread::sleep(std::time::Duration::from_millis(1200));
-                    // SAFETY: só envia SIGTERM ao processo anterior do próprio usuário.
+                    // SAFETY: only sends SIGTERM to the previous process owned by the invoking user.
                     unsafe {
                         if libc::geteuid() == 0 {
                             libc::kill(pid, libc::SIGTERM);
@@ -646,10 +649,10 @@ fn main() {
                 });
             }
 
-            // Captura crua e modo monitor exigem root: pede elevação assim
-            // que o app abre, sem esperar o usuário procurar um botão. Se
-            // a autorização falhar, a janela continua aberta e a interface
-            // mostra o aviso (com um botão pra tentar de novo).
+            // Raw capture and monitor mode require root: request elevation as soon
+            // as the app launches, without waiting for the user to look for a button. If
+            // authorization fails, the window stays open and the UI
+            // displays a warning banner (with a retry button).
             #[cfg(any(target_os = "linux", target_os = "macos"))]
             if unsafe { libc::geteuid() != 0 } && std::env::var("SABIA_REPLACE_PID").is_err() {
                 let handle = app.handle().clone();