Function app_allowed 

pub fn app_allowed(allowlist: &[String], app: &str) -> bool

True when app is permitted by allowlist. An empty allowlist permits every app; otherwise the process name must match an entry (case-insensitive, trimmed). app may be a full path or a bare exe name — we compare on the file name component so C:\\…\\chrome.exe matches chrome.exe.