Service: remove the "send all applications" option (finish what the main app did)

Ed asked back on 2026-07-16 to drop "send all applications" from the app AND the
service - applications mode = pick specific apps only. The main app was done; the
service kept it. Worse, a code comment had pinned it in place as a DELIBERATE
divergence ("the headless service streams system audio, so send-all stays"), which
is exactly why the earlier removal skipped the service. Standing rule bit us: the
service silently diverged from the main app.

Removed across the whole service path, not just the checkbox:
- ServiceProfileDialog: dropped the "Send all applications" AccessibleCheckBox, its
  event wiring and visibility branch; applications mode now always shows the specific-
  apps list. Renumbered the tab's Alt hints (apps Alt+3, inputs Alt+4) now the box is
  gone. Save forces SendAllApplications=false so a stale profile can't resurrect it.
- ServiceSendHost.BuildSendSpecs: deleted the SendAllApplications branch (and the now-
  dead ResolveDefaultRenderId helper). Apps mode builds one process-loopback spec per
  ticked app - identical to the main app.
- Profile.SendAllApplications: marked vestigial (kept only so old profiles deserialize;
  nothing reads it now).

Guard so it can't drift again: the Service-sender-parity self-test now asserts apps
mode produces only per-application specs and NEVER a whole-system loopback spec, even
with SendAllApplications=true. (The old parity test only exercised devices mode, which
is why it missed this.)

Service UI audit (Ed's question): the whole service UI is house-controls throughout -
QuietTabControl, AccessibleCheckBox, MnemonicLabel, Theme.SectionHeader/AppIcon,
FormLayoutRows, CheckedListAccessibility. No raw CheckBox/TabControl (which are silent
to NVDA on .NET 10) anywhere in Service*.cs.

Gate 43/43.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/RemSound.App/SelfTest.cs

@@ -914,7 +914,22 @@ internal static class SelfTest
             $"the service must FORCE Opus regardless of the profile codec (got {cfg.Codec})");
         Check(cfg.Frame == 120,
             $"the service must force the 2.5 ms live Opus frame (120 samples), regardless of the profile (got {cfg.Frame})");
-        return "service forces Opus + 2.5ms frame + lock-to-clock regardless of profile; crypto matches";
+
+        // Applications-mode parity with the main app: specific apps only. Even with the legacy
+        // SendAllApplications flag set true, the service must NOT emit a whole-system "all applications"
+        // loopback spec — it must build one process-loopback spec per ticked app. (Guards the drift where
+        // the service kept the removed "send all applications" checkbox + code path — Ed, 2026-07-17.)
+        if (RemSound.Sender.ProcessLoopbackCapture.IsSupported)
+        {
+            var appsProfile = new Profile { WasapiSendMode = "applications", SendAllApplications = true };
+            appsProfile.SelectedSendApplications.Add("nonexistent-proc-for-test");
+            var appSpecs = ServiceSendHost.BuildSendSpecs(appsProfile);
+            Check(!appSpecs.Any(s => s.Kind == CaptureKind.Loopback),
+                "applications mode must NOT produce a whole-system loopback spec, even with SendAllApplications=true");
+            Check(appSpecs.All(s => s.Kind is CaptureKind.ProcessLoopback or CaptureKind.Input),
+                "applications mode must build only per-application (or input) specs — the 'send all' path is gone");
+        }
+        return "service forces Opus + 2.5ms frame + lock-to-clock; apps mode is specific-apps-only; crypto matches";
     }
 
     /// <summary>The lock-screen service's app-yield token: while a hold is active the service must see an