Implement UIPI-based elevated-window detection, tile-around, and badge

## Problem / goal

Implement UIPI-based elevated-window detection so Bastion tiles *around* elevated windows it cannot legally move, rather than silently failing to place them or fighting a losing battle against `ERROR_ACCESS_DENIED`.

## References

- `DESIGN.md` §3.6 — UIPI detection: `SetWindowPos`/`ShowWindow` from a medium-IL process against a high-IL window fail with `FALSE` + `GetLastError()==ERROR_ACCESS_DENIED` — observed on the design's target build 26200, **not** documented UIPI contract, corroborated only by Microsoft's PowerToys docs; combine with a token-elevation check + verify-after-move before marking `Unmanaged(Elevated)`.
- `DESIGN.md` §9 edge-case table, Elevated window row — subtract its screen area from the work area so tiles go around it; bar badge offers one-click admin-mode onboarding.
- `DESIGN.md` §13 item 4 — this is exactly the accepted-risk item tracked there; this issue is the implementation, the risk-register issue covers the ongoing-risk half.
- Depends on the Placement Executor issue (this detection lives inside it, per DESIGN.md §3.6) — this issue extends that component rather than being fully standalone.
- **Requires a Tier-5 canary** (`docs/engineering/testing.md` §7, and the canary-CI-job tracking issue) before this behavior can be treated as load-bearing — do not ship this detection as silently trusted without one.

## Acceptance criteria

- [ ] A `SetWindowPos`/`ShowWindow` failure returning `FALSE` with `GetLastError()==ERROR_ACCESS_DENIED`, combined with a positive token-elevation check on the target process and a verify-after-move confirming no change, marks the window `Unmanaged(Elevated)`.
- [ ] An elevated window's screen area is subtracted from its monitor's work area so other tiles route around it rather than under it.
- [ ] A one-click "N elevated windows unmanaged — enable admin mode?" affordance exists (bar-level UI is a v0.3 concern — a logged/queryable state flag satisfying this is enough here if the bar doesn't exist yet).
- [ ] A Tier-5 canary test exists pinning the `ERROR_ACCESS_DENIED` behavior on the current Windows build (see `docs/engineering/testing.md` §7's Tier 5 description).

Start with DESIGN.md §3.6 and §9, then inspect the Placement Executor component where UIPI detection belongs. Read docs/engineering/testing.md §7 before adding the required Tier-5 canary for the current Windows build. Done means elevated windows are detected and marked Unmanaged(Elevated), tiles route around their screen area, and a logged or queryable admin-mode affordance is present.

Written by the indexing model from the issue text.