fix(models): remember per-model memory-fit override

[quiet-node]

Description

The "may not fit in memory" warning fires every time a model that sits just over the safe limit is loaded, even after the user has already decided to load it. This adds an "Always allow this model" choice that remembers that decision per model, plus a Settings section to undo it. Loads that are dangerously over the limit are never remembered and always warn.

Key changes

• Adds a freeze band to the memory gate: an estimate needing at least 3x the memory that is free right now. A per-model override never suppresses this band, only a per-turn force does, because free RAM is dynamic and a gross over-commit can wire non-pageable Metal memory the machine does not have.
• Stores accepted overrides in behavior.dismissed_memory_fit_models, keyed by the model's weights SHA-256. The loader validates each entry as a real digest, dedupes, and caps the list at 64 with FIFO eviction, so a hand-edited config cannot inject garbage or grow it without bound.
• Splits the force action on both warning surfaces (the in-chat card and the ambient ask-bar strip) into "Load once" and "Always allow this model". The backend sends a can_remember flag with the fit figures, so the frontend never carries a copy of the freeze threshold.
• Gives the freeze band its own severity-first presentation: a "Memory critically low" tag, a red accent, and a blunt note about the risk, with no remember option offered.
• Keeps the ambient strip's two-click confirm in both bands, so the freeze-band force is never cheaper to trigger than the milder one. A stray click on a strip that appears unprompted cannot lock up the machine.
• Adds remember_model_memory_fit and forget_model_memory_fit commands, which persist through the same lock, atomic-write, and broadcast path as every other config mutation.
• Adds a "Models allowed over the memory limit" section to Settings > Behavior, listing each remembered model with a per-row Remove that re-arms the warning. The section is keyed by digest, so an entry whose model was since uninstalled is still removable.

Testing

bun run test:all:coverage and bun run validate-build both pass clean, with the 100% coverage gate holding.

Note

The in-chat error card still forces on a single click in both bands, unchanged from before this PR. That surface only appears in response to a turn the user just sent, so it is not the stray-click risk the ambient strip is.