chore: call gate checks the active profile only

Checking every profile made a denied call unrecoverable — the process quits
before the operator can change it, and no profile switch could get back in.
Gating on the active profile alone keeps "--profile <other>" as a way back in,
and still turns away a denied operator whose active call is the blocked one.

app.go

@@ -986,17 +986,12 @@ func (a *App) startup(ctx context.Context) {
 	}
 	a.settings.SetProfile(active.ID)
 	a.settingsScoped.Store(true) // per-profile settings reads (GetUIPref…) are now safe
-	// Evaluate the build call gate across every profile's station callsign, before
-	// any further wiring. A denied call exits here, silently.
-	{
-		gate := []string{active.Callsign}
-		if list, lerr := a.profiles.List(a.ctx); lerr == nil {
-			for _, p := range list {
-				gate = append(gate, p.Callsign)
-			}
-		}
-		enforceCallGate(gate...)
-	}
+	// Evaluate the build call gate on the ACTIVE profile's station callsign, before
+	// any further wiring. A denied call exits here, silently. Only the active
+	// profile is checked (not every profile) so that "--profile <other>" is always
+	// a way back in — a blocked call is otherwise unrecoverable, since the process
+	// quits before the operator can change it.
+	enforceCallGate(active.Callsign)
 	// US county resolver — its own local SQLite (data/uls.db), populated on demand
 	// by DownloadULSCounties. Opening (creating an empty store) is cheap and never
 	// fatal: county resolution simply stays inert until the operator downloads it.