security: split overlay window capabilities from main

[victorlucss]

Source: Security review for v0.2.0.

`src-tauri/capabilities/default.json` — the overlay window shares the entire capability set with main, so a compromise of either grants full access to recording, dictation, settings, and DB delete. Overlay HTML is a separate URL (`index.html?overlay=true`) and only needs a small subset.

Recommendation:

• Split into `default.json` (main only) and `overlay.json` (overlay only) capability files.
• Overlay's permissions: `core:window:allow-show/hide/set-size/set-focus/start-dragging`, the dictation status/level reads, and emit-only event access. No `core:default`, no DB write commands, no settings writes.

Touched files: `src-tauri/capabilities/default.json` (new `overlay.json` to be added)