UI: ask once about anonymous usage; Help › Settings › Privacy (#238)

The first run asks whether to share anonymous usage (only when the host
says this run may), the answer and a random install id are kept in the
preferences, and Help › Settings… changes it. Commands are counted by
where they came from (ui, palette, script; mcp when the MCP server says
so), and cancelled forms and clicks on commands that cannot run yet are
recorded. The preferences go through a PrefsStore (a file, or the
browser's storage). Control channel: ui.settings, ui.prompt answers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UhhZMBTviDQxZvwnyP89fo

crates/ui-egui/src/palette.rs

@@ -73,6 +73,10 @@ pub fn matches(query: &str) -> Vec<Hit> {
 /// Run a line of command-line input: `id {json}` runs the command with those parameters, `id`
 /// starts it, anything else starts the best match.
 pub fn submit(app: &mut ModelApp, line: &str) {
+    app.with_origin(fieldcraft_engine::usage::Origin::Palette, |app| submit_line(app, line));
+}
+
+fn submit_line(app: &mut ModelApp, line: &str) {
     let line = line.trim();
     if line.is_empty() {
         return;
@@ -246,7 +250,7 @@ pub fn popup(app: &mut ModelApp, ctx: &egui::Context) {
     if let Some(id) = picked {
         app.palette_text.clear();
         app.ui.palette = false;
-        let _ = app.start(id);
+        let _ = app.with_origin(fieldcraft_engine::usage::Origin::Palette, |app| app.start(id));
     } else if !open || ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
         app.ui.palette = false;
         app.palette_text.clear();