Service: isolate the profile in ProgramData, out of all normal profile paths

Local checkpoint - NOT for public release. Ed: the service profile must never be
reachable except through the Service menu.

Also fixes a real bug: the service runs as SYSTEM, whose per-user data folder is NOT the
interactive user's - so a profile saved in the user's profiles folder (or AppConfig, both
per-user) was invisible to the service. It would have idled, never streaming.

- New RemSound.Core.ServiceStore: the service profile + its settings (logging) live in a
  MACHINE-WIDE ProgramData\RemSound\service location - same absolute path for the user
  (config dialog) and SYSTEM (service). Moved ServiceProfileName/ServiceLoggingEnabled off
  AppConfig (per-user) onto this store.
- ServiceSendHost.FromConfig + RemSoundService now read ServiceStore; ConfigureServiceProfile
  saves there (and migrates + deletes any profile left in the old user-folder location).
- Because it's no longer in the user's profiles folder, it can't appear in the startup
  picker, File->Open, Recent profiles, or the password manager (all of which read the user
  ProfileStore); the reserved-title filter in ListProfileTitles stays as belt-and-braces.
- Password button renamed "Set service profile password".
- New self-test "Service profile isolation": store is under ProgramData, the reserved title
  is filtered from the listing, and it round-trips through the machine-wide store.

Gate 27/27.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/RemSound.Core/AppConfig.cs

@@ -244,18 +244,9 @@ public sealed class AppConfig
     /// Startup behaviour dialog. Null = always show the picker (legacy behaviour).</summary>
     public string? StartWithProfileTitle { get; set; }
 
-    // === Lock-screen send-only service (the RemSound Windows service) ===
-    /// <summary>The title of the profile the RemSound Windows service loads and streams from. Null =
-    /// no service profile configured yet. Machine-wide, set from the Service menu's config dialog. The
-    /// service is send-only / WASAPI-only; this profile is edited exclusively through that dialog and is
-    /// kept out of the normal profile picker.</summary>
-    public string? ServiceProfileName { get; set; }
-
-    /// <summary>Whether the RemSound Windows service writes its own log file. Separate from the app's
-    /// machine-wide <see cref="LoggingEnabled"/> so you can diagnose the headless service without
-    /// turning on logging for the interactive app. Off by default. Set from the service config dialog's
-    /// "Additional options". Machine-wide.</summary>
-    public bool ServiceLoggingEnabled { get; set; }
+    // The send-only service's profile + settings live in the machine-wide RemSound.Core.ServiceStore
+    // (ProgramData), NOT here — AppConfig is per-user, but the service runs as SYSTEM and needs the same
+    // file the user wrote. (ServiceProfileName / ServiceLoggingEnabled were moved there 2026-07-12.)
 
     /// <summary>How often RemSound polls the GitHub Releases API for a newer build. Default
     /// <see cref="UpdateCheckFrequency.Every24Hours"/>. Set to <see cref="UpdateCheckFrequency.Never"/>