chore(hardening): tighten security and footprint defaults

src/routes/+layout.svelte

@@ -324,6 +324,10 @@
     // calls from DictationPage around cleanup_transcript_text_cmd.
     refreshLlmStatus(settings.aiTier).catch(() => {});
 
+    if (settings.prewarmModelOnStartup) {
+      invoke("prewarm_default_model_cmd").catch(() => {});
+    }
+
     // Meeting auto-capture: poll the process list and toast when a match
     // appears (edge-triggered — no repeat toasts until the app goes away
     // and comes back). We never start recording from this signal; the