feat(llm): add hosted_ai_acknowledged settings field (T10.3/M3.3)

One-time "data leaves your device" acknowledgment flag for hosted
(non-local) AI providers, persisted like consent_acknowledged so the
banner doesn't nag on every use. serde(default) so it's false for any
settings.json written before this field existed.

src-tauri/src/models.rs

@@ -202,6 +202,13 @@ pub struct Settings {
     // Recording retention (ADR-0009). Default OFF.
     pub default_record: bool,
     pub consent_acknowledged: bool,
+    /// One-time "data leaves your device" acknowledgment for hosted
+    /// (non-local) AI providers — Anthropic, or a hosted OpenAI-compatible
+    /// gateway (ADR-0011, T10.3/M3.3). Shown once before first hosted use;
+    /// this flag is what makes it not nag every time. Independent of
+    /// `consent_acknowledged` (that one's specifically about recording law).
+    #[serde(default)]
+    pub hosted_ai_acknowledged: bool,
     // Sync master switch (ADR-0010). Default OFF. Target rows live in the DB; secrets in OS keychain.
     pub sync_enabled: bool,
     // Storage retention policy (FR-STORE-2). None = no cap on that dimension.