feat(ui): add Scanner Denied state matching Figma node 32:2

[ilmoniemi]

User Story

As a Pyrycode mobile user who denied the camera permission, I want a dedicated state screen explaining the permission requirement, so I can recover via Settings or fall back to pasted code without confusion.

Context

Figma node 32:2 (Scanner — Denied state variant) doesn't exist in code today. The pairing flow lands on the main Scanner (app/src/main/java/de/pyryco/mobile/ui/onboarding/ScannerScreen.kt) without a denied-permission branch. When CameraX lands in Phase 4, the runtime permission flow will need this state surface. Pre-building the visual now decouples Figma-fidelity work from CameraX integration, and slots into the Phase 1.5 Figma-anchored catchup wave (after Welcome #57).

Acceptance Criteria

• New composable ScannerDeniedScreen in app/src/main/java/de/pyryco/mobile/ui/onboarding/ renders the camera-with-diagonal-strike illustration from Figma node 32:2 (rect + 2 ellipses + viewfinder bridge path + error-color strike line)
• Headline "Camera permission required" and the body explainer paragraph match Figma node 32:2 copy and use M3 typography roles (no hardcoded TextStyle)
• Primary action is a filled M3 Button labelled "Open settings"; secondary action is an M3 TextButton labelled "Paste code instead". Both take () -> Unit lambdas; the screen itself launches no intents and performs no navigation
• All colors bind to MaterialTheme.colorScheme.*; the strike line uses colorScheme.error
• @Preview composables for light and dark variants visually match the Figma screenshot side-by-side

Technical Notes

Scope discipline:

• Single new file alongside ScannerScreen.kt. Do NOT wire into MainActivity's NavHost in this ticket — runtime permission routing arrives with CameraX in Phase 4, and the caller (not this screen) owns Intent.ACTION_APPLICATION_DETAILS_SETTINGS construction.
• Mirror the existing ScannerScreen.kt (95 LOC) for Surface, systemBarsPadding, and PyrycodeMobileTheme preview wrapping conventions.

Asset & rendering pointers:

• The camera-with-strike illustration is small enough to draw in Compose Canvas directly (rect + ellipses + path + line). If get_design_context exposes a clean SVG export, an ImageVector drawable under app/src/main/res/drawable/ is also acceptable — architect picks based on the design payload.
• Use the M3 typography roles the Figma binds (verify via get_design_context, do not guess).

Size Estimate

S — single file, ~60-100 production lines: M3 layout (Surface + Column + Button + TextButton) plus a small Compose Canvas or ImageVector illustration. Self-contained: no data layer, navigation, or DI changes.

Figma

https://www.figma.com/design/g2HIq2UyPhslEoHRokQmHG?node-id=32-2

[ilmoniemi]

🤖 Product Owner — creates structured issues

po agent has completed work on this ticket.

Agent output (click to expand)

Refined #61. Changes applied:

- **Size:** `XS-S` (invalid range) → `size:s` label (single value, work falls in the 60–100 LOC band over the XS <30-LOC ceiling).
- **AC cleanup:** dropped two non-testable items — the `(architect picks)` parenthetical on the Settings button and the "NavHost wiring NOT required" meta-note. Both moved into **Technical Notes** as scope discipline.
- **Boundary tightened:** the screen takes `() -> Unit` lambdas; intent construction and navigation belong to the Phase 4 caller. This keeps the ticket truly self-contained and testable without a runtime-permission harness.
- **Theming guardrail folded into AC:** `colorScheme.*` binding + `colorScheme.error` for the strike line, matching the #57 Welcome pattern.
- **Context anchored:** linked existing `ScannerScreen.kt` (95 LOC) as the convention mirror and #57 as the prior smoke-test reference.
- **Figma section preserved** verbatim. **Not security-sensitive** (no auth/token/crypto/network input).

Dispatcher auto-adds `ready:po` on completion.

Ready for human review. Move to the next column when approved.

[ilmoniemi]

🤖 System Architect — defines Go interfaces, data flows, concurrency patterns

architect agent has completed work on this ticket.

Agent output (click to expand)

Spec written and committed.

**Summary:** Sized S (1 new file, ~120 production lines, 0 call sites changed, no edits to existing files). Branch overlap with #60 turned out spurious — #60 modifies `ScannerScreen.kt`, this ticket creates a new `ScannerDeniedScreen.kt`. No security-sensitive label, so no security review pass.

**Design highlights:**
- Mirrors `ScannerScreen.kt` shell (`Surface` + `systemBarsPadding` + light/dark previews wrapped in `PyrycodeMobileTheme`).
- Two-lambda contract: `onOpenSettings: () -> Unit`, `onPasteCode: () -> Unit`. No `Context`, no `Intent`, no navigation.
- Illustration drawn directly in `Canvas` (rect + viewfinder bridge `Path` + 2 lens ellipses + `error`-color diagonal strike).
- One intentional Figma deviation documented: omits the `TopAppBar` (matches the parent `ScannerScreen.kt` and the AC's no-navigation rule — NavHost concern for Phase 4).
- Tests: previews only, matching the existing onboarding-screen bar.

Ready for human review. Move to the next column when approved.