fix(diagnostics): default sensitive diagnostics to disabled

[skyfireitdiy]

Summary

Fixes #3213. The settings UI promises that sensitive diagnostics are off by default, but the backend configuration and runtime flags enabled them by default. Sensitive request bodies and frontend event payloads now require an explicit opt-in, including before configuration finishes loading. Saved boolean preferences are preserved.

• Default the Rust persisted configuration and AI adapter startup flag to false.
• Start the frontend logger with sensitive diagnostics disabled; keep missing startup values and non-boolean configuration-change values disabled.
• Cover startup trace output with the real frontend logger and event batcher while configuration reads are pending. Verify that saved true and false preferences still take effect after loading.
• Add configuration-change regression cases and document the focused verification command.

Verification

• cargo test --locked --offline -p openbitfun-config-contracts --lib: 101 tests passed.
• Focused FrontendLogLevelSync, startup privacy, logger, and event batcher tests: 24 tests passed.
• pnpm run check:web: passed after syncing the latest main and preparing generated types and Monaco assets.
• ESLint on the changed production TypeScript files: passed.
• Reverting the two additional frontend guards makes six regression cases fail.
• git diff origin/main...HEAD --check: passed.

AI-assisted implementation; focused local tests and Web checks completed. No browser automation was used. Live remote workspace, remote control, Peer Device Mode, and Detached Dispatch scenarios were not exercised.

Closes #3213.