chore(hardening): tighten security and footprint defaults

src/lib/pages/SettingsPage.svelte

@@ -1805,6 +1805,14 @@
                 {/if}
               </p>
             </div>
+
+            <div class="mt-5">
+              <Toggle
+                bind:checked={settings.prewarmModelOnStartup}
+                label="Prewarm transcription model on startup"
+                description="Loads Whisper after the app opens. Faster first capture, but higher idle memory use."
+              />
+            </div>
           </div>
         {/if}
       </div>

src/lib/stores/page.svelte.ts

@@ -64,6 +64,7 @@ const defaults: SettingsState = {
   llmModelId: null,
   llmPromptPreset: "default",
   aiGpuConcurrency: "parallel",
+  prewarmModelOnStartup: false,
   saveAudio: false,
   outputFolder: "",
   globalHotkey: "Ctrl+Shift+R",

src/lib/types/app.ts

@@ -51,6 +51,7 @@ export interface SettingsState {
   llmModelId: LlmModelIdStr | null;
   llmPromptPreset: LlmPromptPreset;
   aiGpuConcurrency: AiGpuConcurrency;
+  prewarmModelOnStartup: boolean;
   saveAudio: boolean;
   outputFolder: string;
   globalHotkey: string;

src/routes/+layout.svelte

@@ -324,6 +324,10 @@
     // calls from DictationPage around cleanup_transcript_text_cmd.
     refreshLlmStatus(settings.aiTier).catch(() => {});
 
+    if (settings.prewarmModelOnStartup) {
+      invoke("prewarm_default_model_cmd").catch(() => {});
+    }
+
     // Meeting auto-capture: poll the process list and toast when a match
     // appears (edge-triggered — no repeat toasts until the app goes away
     // and comes back). We never start recording from this signal; the