fix(client): honor trusted remote management grant

[Grivn]

Summary

• derive Mnemon workspace write controls from the Host settings capability grant instead of connection.isLoopback
• pass the same settings capability into the assistant-message save action
• preserve activation-only behavior when remote management is unavailable and add positive coverage for explicitly authorized remote Hosts

Why

remoteAccess: trusted-host promotes the write, settings, and pack RPC channels at Host startup, but the v0.2.6+ client still disabled memory writes whenever isLoopback was false. This caused the UI to reject authorized remote writes before transport even though the Host had granted them.

Validation

• vitest run: 345 passed, 1 Windows-only test skipped
• tsc -p tsconfig.json --noEmit
• tsdown
• tsc -p tsconfig.types.json
• git diff --check