Key the dialog dedup by the identity its gate accepts

The gate treats an empty app_uid as absent and falls through to the
origin; the dedup key used ?? and kept the empty string, so two requests
from different origins would collide on one key and share a single
decision. No caller can produce a blank uid today — server uids are
never empty and the IPC path's empty attribute is stopped by the gate —
but the two lines have to agree.

src/gui/src/UI/UIPermissionDialog.js

@@ -67,7 +67,10 @@ async function UIPermissionDialog (options) {
         return false;
     }
 
-    const pending_key = `${options.app_uid ?? options.origin ?? ''}\n${options.permission}`;
+    // `||`, not `??`: the gate above treats an empty uid as absent, so the key
+    // has to fall through to the origin too — otherwise two different origins
+    // arriving with a blank uid would share one decision.
+    const pending_key = `${options.app_uid || options.origin || ''}\n${options.permission}`;
     if ( pending_dialogs.has(pending_key) ) {
         return pending_dialogs.get(pending_key);
     }