Lumeira 1.2.1

Fixed

• Finder-opened and drag-dropped images now render under App Sandbox. When the parent folder hadn't been granted to Lumeira, enumerator.siblings(of:) returned an empty list (FileManager's enumerator returns nil for unauthorized parents and FolderEnumerator mapped that to EnumerationResult.empty), so ViewerState.open(url:) set files = [], currentFile was nil, and loadCurrentImage early-returned silently — no error message, no image, just the WelcomeView. open(url:) now falls back to a single-element file list built from the granted file URL so the image renders immediately, and surfaces a new needsFolderAccess flag for the UI.

Added

• FolderAccessStore (LumeiraCore) — security-scoped bookmark store that persists per-folder grants in UserDefaults keyed by standardized path. Refreshes stale bookmarks transparently, tracks active scope sessions so the previous folder's scope is stopped on switch, and exposes hasBookmark(for:) for the UI.
• ViewerState.requestFolderAccess() — presents an NSOpenPanel pre-pointed at the current image's parent folder. On accept, validates the chosen folder contains the current image, saves a security-scoped bookmark, starts the scope, and re-runs open(url:) so sibling navigation lights up immediately.
• Folder-access banner in ContentView — translucent material card at the top of the viewport with a "Grant Access…" button, shown only while viewer.needsFolderAccess is true. Disappears the moment the bookmark is granted.
• Bookmark auto-save in openFolder(url:) — folders opened via the standard "Open Folder…" panel are persisted automatically, so subsequent single-file opens inside those folders skip the prompt entirely (including across launches).

Changed

• open(url:) idempotent guard now respects needsFolderAccess, so re-running after a grant actually executes (otherwise the guard short-circuits when currentFile matches and files.count == 1).