Move runtime data out of app bundle into user Application Support

[techmore]

Problem\nRuntime data (scans, settings, runtime DB, tokens) is stored under the app bundle (BASE_DIR/data). When the app is installed in /Applications, the bundle is not user-writable and can be overwritten by rebuilds or updates, risking data loss and permission failures.\n\n## Evidence\n- nmapui/paths.py defines SCANS_DIR, SETTINGS_FILE, RUNTIME_DB_FILE, etc. as BASE_DIR / data.\n- build.sh copies data into the app bundle and installs it to /Applications.\n\n## Proposed Fix\n- Move mutable runtime paths to ~/Library/Application Support/NmapUI (or OS-equivalent).\n- Keep read-only assets (templates, xsl, vulners scripts) in the bundle.\n- Add a migration step on startup to move existing data from bundle to Application Support if present.\n- Allow overrides via env vars (NMAPUI_DATA_DIR) for power users.\n\n## Notes\nThis also reduces the need to run the app with elevated privileges just to write runtime data.

[techmore]

Tracking under #163 (Runtime data lifecycle).

[techmore]

Fixed in 61edcff. nmapui/paths.py now resolves mutable data paths through DATA_DIR with priority: (1) $NMAPUI_DATA_DIR override, (2) ~/Library/Application Support/NmapUI, (3) BASE_DIR/data legacy fallback. A migrate_legacy_data_dir() function copies existing bundle data on first upgrade. Read-only assets stay in the bundle.