[zackees]

Closes #27

Adds the off, encrypted, ro, and rw file-sharing setting, defaulting to ro for existing settings files. The viewer captures the effective tier at session start, supports DOCKER_VM_FILE_SHARING for one launch, and shows the saved and running tiers separately in Settings.

Verification:

• nix build .#docker-vm -o /tmp/docker-vm-issue-27-result passed, including Rust unit tests.
• On a private Xvfb display with a throwaway config, selected Read & write, clicked Restart session, then observed the replacement viewer report Running session: Read & write; the saved setting contained "file_sharing": "rw".
• With a saved rw setting and DOCKER_VM_FILE_SHARING=off, the panel reported Running session: Off; saved setting: Read & write and listed the launch override.
• Test viewers were terminated by exact PID; their containers and networks were removed.

This PR adds the tier setting and panel only. Drop-zone binding and mount enforcement are tracked in the subsequent sub-issues of #35.