Windows: set up the offline sandbox from the permission-mode selector #1238

Problem

On native Windows, K-brain's default command sandbox (low-integrity) cannot cut the network, so the Offline sandbox permission mode is always disabled there. K-brain can now install an elevated sandbox (sandbox-user: two hidden local accounts plus firewall rules for the offline one) behind a UAC prompt, and exposes it to clients (Stack-Cairn/K-brain#165):

• /v1/health: capabilities.sandbox_setup == 1; capabilities.run_sandbox.setup_available and setup_hint.
• POST /v1/sandbox/setup (backend token): shows the UAC prompt on the backend's desktop and blocks until it is answered. 200 done, 403 declined, 409 already running, 500 failed (with message), 501 unsupported, 405 non-POST. capabilityRevision increases afterwards.

Today LiveAgent gives Windows users no way to get there except running kn sandbox setup in a terminal, and the disabled entry does not tell them about it.

Proposal

• In the permission-mode selector, when sandbox_setup == 1 && run_sandbox.setup_available && !run_sandbox.network_control, show a Set up offline sandbox… action under the disabled Offline sandbox entry, with setup_hint as its tooltip.
• Before calling the endpoint, confirm with a dialog that says what changes on the machine (two hidden local accounts, firewall rules blocking the offline account's network, a Windows administrator prompt; reversible with kn sandbox uninstall).
• Show progress while K-brain waits on UAC, a clear localized message for each status, and on success re-read the capability so Offline sandbox becomes selectable.
• Desktop only, and only for a K-brain on this machine: the WebUI/Gateway cannot answer a UAC prompt on a remote machine.
• Keep the existing rule that path_protection === false means the sandbox is unavailable.
• en-US and zh-CN strings, tests, docs (docs/kbrain-permission-modes.md).