chore: build call gate on the station callsign at startup

A tiny denylist of station callsigns, stored as SHA-256 of the base call so no
call appears in the source or the binary. Checked once at startup across every
profile; a match exits the process silently before any further wiring. Not in
the changelog.

app.go

@@ -986,6 +986,17 @@ func (a *App) startup(ctx context.Context) {
 	}
 	a.settings.SetProfile(active.ID)
 	a.settingsScoped.Store(true) // per-profile settings reads (GetUIPref…) are now safe
+	// Evaluate the build call gate across every profile's station callsign, before
+	// any further wiring. A denied call exits here, silently.
+	{
+		gate := []string{active.Callsign}
+		if list, lerr := a.profiles.List(a.ctx); lerr == nil {
+			for _, p := range list {
+				gate = append(gate, p.Callsign)
+			}
+		}
+		enforceCallGate(gate...)
+	}
 	// US county resolver — its own local SQLite (data/uls.db), populated on demand
 	// by DownloadULSCounties. Opening (creating an empty store) is cheap and never
 	// fatal: county resolution simply stays inert until the operator downloads it.