Add application-driven policy generation with an acknowledgement gate

Ticking "Required on all PCs" now generates a configuration policy that
installs the application on every non-server endpoint it matches, rather
than only flagging a software-compliance report row.

Because that save is a fleet-wide deployment, it requires explicit
acknowledgement. The gate is enforced in the API, not only in the form:
a confirmation dialog that can be sidestepped by POSTing directly is
decoration, not a safeguard. It fires only on the transition INTO the
required state, since re-saving an already-required application deploys
nothing new.

Generated policies carry a new 'autoapp' source. They stay editable, and
hand-editing one transfers ownership to 'local' so it survives a later
uncheck; 'shipped' remains read-only. Existing required applications are
not migrated retroactively - policies are only created on save.

Also adds the monitorable fields that the shipped-policy breakup will
build on, and repairs a mangled non-ASCII byte in copilot-instructions.md
that was failing the style gate.

shopdb/core/models/application.py

@@ -33,6 +33,20 @@ class Application(BaseModel):
         db.Boolean, default=False,
         comment='Required on all PCs (drives the software-compliance report)'
     )
+    # Monitorable: this app can be watched by the endpoint agent as a process
+    # monitor. A monitor is useless without something to launch and something to
+    # look for, so both fields below are REQUIRED whenever this is set - enforced
+    # in the applications API rather than as a DB constraint, because the columns
+    # must stay nullable for the rows that existed before this shipped.
+    ismonitorable = db.Column(
+        db.Boolean, default=False,
+        comment='Can be watched by the endpoint agent (needs launch path + process name)'
+    )
+    # Full path used to START the app when a monitor finds it not running.
+    monitorlaunchpath = db.Column(db.String(512))
+    # Windows image name to watch for, e.g. "notepad.exe". This is what the agent
+    # matches against the running process list.
+    monitorprocessname = db.Column(db.String(255))
     image = db.Column(db.String(255))
     # Digest of the app-level uploaded installer (installpath). Lets the
     # endpoint update_app push resolve an install source by app alone, with no