Opt-in encrypted capture for training data

[Jam-Cai]

To train tabby-native-1 we need real (prefix, accepted completion) pairs. That data is sensitive: off by default, encrypted at rest, local-only until explicit export, redactable/deletable. Use SQLCipher with the key in Keychain.

Acceptance

• Off by default; cannot be enabled without explicit one-time consent dialog.
• Storage uses SQLCipher with key material in Keychain.
• UI to view recent captures, delete all, and export as JSONL.
• Redaction pass for obvious secrets (AWS / GitHub tokens, long base64 blobs) before write.
• No network egress of captured data by Tabby itself.

Parent: #15

[FuJacob]

Closing for OSS launch cleanup. Heavy infrastructure (SQLCipher + Keychain + consent UI) for training data that doesn't exist yet. Can reopen when training pipeline is closer to reality.