app-server: disable remote control without sqlite

[euroelessar]

Why

Remote control depends on the app-server SQLite state DB for persisted enrollment identity. If the state DB cannot be opened at startup, continuing with remote control enabled leaves the process in a misleading state where enrollment identity cannot be read or persisted.

Feature-disabled remote control remains disabled regardless of SQLite state. This only changes the case where remote control is requested but the SQLite state DB is unavailable.

What changed

• Logs SQLite state DB initialization failures instead of dropping the error silently.
• Treats remote control as effectively disabled when the SQLite state DB is unavailable.
• Prevents RemoteControlHandle::set_enabled(true) from enabling remote control later in the same process if the state DB was unavailable at startup.
• Keeps the existing behavior that disabled remote control does not validate or connect to the remote-control URL.
• Makes persisted enrollment load/update failures propagate as remote-control errors instead of silently falling back to in-memory state.
• Makes the direct websocket connection path fail when called without a SQLite state DB.
• Adds coverage for startup without a state DB, later handle enablement with no state DB, and direct websocket connection without a state DB.

Verification

• cargo test -p codex-app-server transport::remote_control --lib
• just fix -p codex-app-server