feat: add local AI workspace tools

[josh-uk]

Summary

• add explicit semantic search and grounded Ask your notes answers with linked citations
• add reviewed folder suggestions for unfiled notes
• add seven selection writing actions with replace and insert-after previews
• keep all AI local, click-to-run, bounded, cached only in memory, and review-before-apply
• update desktop/mobile UI, privacy/security docs, tests, and README screenshots

Local validation

• npm run check
• 62 unit tests
• 23 integration tests
• migration clean-install and upgrade proof
• security test, static security lint, dependency audit, secret scan
• 18 Playwright journeys plus real-model desktop/mobile visual QA
• production app and migration image builds
• release image smoke on linux/arm64 with denied outbound runtime network
• Trivy: zero fixed high/critical findings
• release audit: 173 tracked files

Models tested

• qwen3.5:4b
• qwen3-embedding:0.6b