Require explicit account consent before sending content to AI providers

[mptfire]

All six content endpoints on main currently return 200 and forward synthetic private account data without an owner consent step (server/server.go:785, server/server_ai.go:131). The new default-denial reproduction fails on main with six mock provider calls, then passes with zero calls after the gate.

Implement the selected per-account policy: require explicit owner acceptance of the provider disclosure, bind it to provider/endpoint/model selections, persist it separately from preferences, and permit owner revocation. Gate cached results, streaming, embeddings, inline enrichment and scheduled briefings; scoped agents cannot consent for owners. Add first-use disclosure, Settings privacy controls, schema 12→13 migrations for both databases, and data-flow/rollback documentation. Existing users begin without consent.

Validation before workspace disconnect: Go build/vet and full local -race suite pass (one existing Unix curl test skipped); all 110 web tests, ESLint, formatting and production build pass. Final remote checks will validate the preserved branch, including PostgreSQL migrations and the added failure/identity edge cases.

Targets main directly. Includes the required authentication/budget restoration from #46 until that PR is merged, so these fixes cannot be stranded on a previously merged feature branch. Draft while final lockfile/format preparation and CI complete; the temporary preparation workflow will be removed before review readiness.

Fixes #27.

[mptfire]

Superseded: per-user AI consent + provider disclosure landed via the #27 implementation (ai-consent-required config, GET /v1/ai/disclosure, PATCH /v1/account/settings ai_consent, enrichment silent-skip). See docs/agents.md and security-audit Addendum 5/6. Closing this draft to avoid two competing consent designs — happy to revisit the per-account (vs per-user) nuance if a multi-user deployment ever needs it.