UI: ask once about anonymous usage; Help › Settings › Privacy (#238)

The first run asks whether to share anonymous usage (only when the host
says this run may), the answer and a random install id are kept in the
preferences, and Help › Settings… changes it. Commands are counted by
where they came from (ui, palette, script; mcp when the MCP server says
so), and cancelled forms and clicks on commands that cannot run yet are
recorded. The preferences go through a PrefsStore (a file, or the
browser's storage). Control channel: ui.settings, ui.prompt answers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UhhZMBTviDQxZvwnyP89fo

crates/mcp/src/backend.rs

@@ -230,7 +230,8 @@ fn temp_png() -> PathBuf {
 
 impl Backend for Remote {
     fn execute(&mut self, command: &str, params: Value) -> Result<Value, String> {
-        self.call("engine.execute", json!({"command": command, "params": params}))
+        // `client` lets the app count an agent's commands apart from a script's (docs/privacy.md).
+        self.call("engine.execute", json!({"command": command, "params": params, "client": "mcp"}))
     }
 
     fn commands(&mut self) -> Result<Value, String> {