disallow to disable guard during focus

desktop/kadence_desktop/qml/SettingsDialog.qml

@@ -81,6 +81,13 @@ Window {
         property string detail: ""
         property bool on: false
         property bool available: true
+        /**
+         * A one-way ratchet: while this is set the switch can be turned on but not
+         * off, so it greys only when it is *already* on. `available` greys both
+         * directions, which is the wrong shape for "you may not switch this off".
+         */
+        property bool lockedOn: false
+        readonly property bool settable: available && !(lockedOn && on)
         signal toggledTo(bool value)
 
         Layout.fillWidth: true
@@ -91,7 +98,7 @@ Window {
             spacing: 1
             Label {
                 text: toggleRow.label
-                color: toggleRow.available ? Theme.ink : Theme.faint
+                color: toggleRow.settable ? Theme.ink : Theme.faint
                 font.pixelSize: 13
                 font.family: Theme.sansFamily
             }
@@ -107,7 +114,7 @@ Window {
         }
         Switch {
             checked: toggleRow.on
-            enabled: toggleRow.available
+            enabled: toggleRow.settable
             onToggled: toggleRow.toggledTo(checked)
         }
     }
@@ -264,11 +271,16 @@ Window {
                     visible: controller.blockerError !== ""
                     text: controller.blockerError
                 }
+                Banner {
+                    visible: controller.blockerLocked
+                    text: controller.blockerLockNote
+                }
 
                 Toggle {
                     label: "Enforce the server's rules here"
                     detail: "Off, this machine is a timer and nothing else."
                     on: dialog.config.enforce_blocking
+                    lockedOn: controller.blockerLocked
                     onToggledTo: (value) => controller.setConfig("enforce_blocking", value)
                 }
                 Toggle {
@@ -276,6 +288,7 @@ Window {
                     detail: "The managed region of /etc/hosts, plus a local DNS stub for the masks it cannot express."
                     on: dialog.config.block_hosts_file
                     available: dialog.config.enforce_blocking
+                    lockedOn: controller.blockerLocked
                     onToggledTo: (value) => controller.setConfig("block_hosts_file", value)
                 }
                 Toggle {
@@ -283,6 +296,7 @@ Window {
                     detail: "/proc is scanned every few seconds and matches are asked to quit, then made to."
                     on: dialog.config.block_apps
                     available: dialog.config.enforce_blocking
+                    lockedOn: controller.blockerLocked
                     onToggledTo: (value) => controller.setConfig("block_apps", value)
                 }
             }