Give a Mac an installer, an app bundle and a menu bar icon it can see

The macOS backends were already here: CoreAudio capture through ffmpeg,
pbcopy and CoreGraphics, Carbon hotkeys, the paths under ~/Library. What
was missing was everything that installs them, so install.sh hands over to
install-mac.sh on Darwin rather than growing a branch per line: the XDG
directories, the .desktop files and the shortcut registry mean nothing
there, and an application is a bundle rather than a path. The bundle
carries a copy of the interpreter, because macOS files the microphone and
Accessibility permissions against the process that asks, and a launcher
running Homebrew's python3 would have asked as python3 and shared the
grant with everything else on that interpreter. It is signed ad-hoc so a
reinstall is the same application rather than two more dialogs, and it
says so plainly when a brew upgrade has moved the tree it needs.
uninstall.sh and update.sh follow it.

The tray icon was invisible: QIcon.fromTheme wants a freedesktop icon
theme and hands back a null icon without one, which in a menu bar is the
whole interface gone. trayicon.py draws the three shapes as template
images, so they follow the menu bar into dark mode, and the bundle's icon
comes off the same glyph rather than a binary in the repository. Linux
keeps its own icons; these are used only where the theme has nothing.

paths.py is the fix that was never about a Mac. config.py imports ggml.py,
so ggml.py could not ask it where the data goes; each worked it out for
itself and only one of them knew about macOS. Settings went to ~/Library
while several gigabytes of models went to ~/.local/share, which is not a
place a Mac user looks and not a place uninstall.sh --purge would have
deleted from.

Ctrl+Space is the input-source switch there and Cmd+Space is Spotlight, so
the default is Ctrl+Option+Space, and hotkey.default_combo is the one
place that difference lives. The first paste asks for Accessibility with
kAXTrustedCheckOptionPrompt, which is what creates the row to switch on;
asking the other way opens a pane Dikte is not listed in. `dikte shortcut
status` asks the running instance, since the combination is held by that
process and by nothing else.

Local speech to text is the one piece a Mac builds by hand. whisper.cpp
publishes no macOS binary and Homebrew's is configured with
WHISPER_BUILD_SERVER=OFF, so it installs whisper-cli and not the server
Dikte talks to; program_path already takes a whisper-server off the PATH
or out of Settings, so the answer is the one a Linux distribution gets,
and the README carries the cmake line. CI grows a macOS job on 3.11 and
3.13, the only place the Carbon and CoreGraphics libraries have to be
there to be opened.

Written and tested on macOS 27.0 arm64. Two things are still unverified on
a Mac: the paste end to end, which waits on the Accessibility toggle, and
a meeting recording, which needs a loopback driver.

dikte.py

@@ -8,6 +8,8 @@ command line says "there is no instance to talk to, so be one".
 """
 
 import contextlib
+import ctypes
+import ctypes.util
 import json
 import os
 import signal
@@ -43,6 +45,7 @@ import hotkey  # noqa: E402
 import i18n  # noqa: E402
 import ipc  # noqa: E402
 import meeting  # noqa: E402
+import trayicon  # noqa: E402
 from i18n import t  # noqa: E402
 from meeting import MeetingPipeline  # noqa: E402
 from overlay import Overlay  # noqa: E402
@@ -218,7 +221,12 @@ class Dikte:
             self._toggle()
 
     def _set_icon(self, name):
+        # The theme first, so a Linux desktop keeps its own icons, then the ones
+        # drawn in trayicon.py. macOS has no theme at all and would otherwise be
+        # handed a null icon, which in a menu bar is an item you cannot see.
         icon = QIcon.fromTheme(name)
+        if icon.isNull():
+            icon = trayicon.icon(name)
         if icon.isNull():
             icon = QIcon.fromTheme("audio-input-microphone")
         self.tray.setIcon(icon)
@@ -473,6 +481,12 @@ class Dikte:
             "agent": assistant.display_name(self.conf),
             "provider": assistant.provider(self.conf),
             "listener": self.evdev.running,
+            # Asked here rather than by the command line, because on macOS
+            # there is no registry to read: a combination is held by this
+            # process and by nothing else, so this is the only process that
+            # can say whether it is.
+            "shortcuts": {name: hotkey.shortcut_status(spec.desktop_id)
+                          for name, spec in hotkey.SHORTCUTS.items()},
         }
 
     def reload_settings(self):
@@ -958,6 +972,51 @@ def install_signal_handlers(app):
     return reader, writer, notifier
 
 
+def _stay_out_of_the_dock():
+    """Ask macOS to treat this as a menu bar application, not a windowed one.
+
+    LSUIElement in the bundle says the same thing, but it is read for the
+    process LaunchServices started, and that is the launcher script rather than
+    the Python it runs: the interpreter is a child, and the child inherits the
+    registration without inheriting the policy. Said here it holds however Dikte
+    was started, including straight from a terminal.
+
+    Accessory rather than Prohibited: a prohibited application cannot put
+    anything in the menu bar, which is the whole interface.
+    """
+    if sys.platform != "darwin":
+        return
+    NS_ACCESSORY = 1               # NSApplicationActivationPolicyAccessory
+    try:
+        objc = ctypes.cdll.LoadLibrary(ctypes.util.find_library("objc"))
+        objc.objc_getClass.restype = ctypes.c_void_p
+        objc.objc_getClass.argtypes = [ctypes.c_char_p]
+        objc.sel_registerName.restype = ctypes.c_void_p
+        objc.sel_registerName.argtypes = [ctypes.c_char_p]
+        # objc_msgSend is a trampoline with no signature of its own, and on
+        # arm64 the arguments have to be in the registers the real method
+        # expects, so each call gets a prototype of its own. Built from the
+        # address: handing CFUNCTYPE the imported function object would make a
+        # callback into it rather than a call through it, and the crash lands
+        # inside the Objective-C runtime with nothing to read.
+        send = ctypes.cast(objc.objc_msgSend, ctypes.c_void_p).value
+        shared = ctypes.CFUNCTYPE(
+            ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p,
+        )(send)
+        policy = ctypes.CFUNCTYPE(
+            ctypes.c_bool, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_long,
+        )(send)
+
+        application = shared(objc.objc_getClass(b"NSApplication"),
+                             objc.sel_registerName(b"sharedApplication"))
+        if application:
+            policy(application, objc.sel_registerName(b"setActivationPolicy:"),
+                   NS_ACCESSORY)
+    except (OSError, AttributeError, TypeError):
+        # A Dock icon is a blemish, not a failure: everything still works.
+        pass
+
+
 def run_app(args):
     command = args[0] if args else ""
 
@@ -965,6 +1024,7 @@ def run_app(args):
     app.setApplicationName("Dikte")
     app.setDesktopFileName("dikte")
     app.setQuitOnLastWindowClosed(False)
+    _stay_out_of_the_dock()
     # Before Dikte is built, because building it is what may start a server, and
     # a signal arriving in the middle of that would otherwise take the default
     # action and leave the server behind. A signal this early lands in the