feat(ai): add an opt-in local model runtime and model manager #76

Implement the production local inference layer after the runtime decision is recorded.

Depends on the local-runtime research issue.

Scope

• AI remains optional; the normal PDF tools work without a model.
• Show model size and minimum memory before setup.
• Support explicit verified download and local-file import where the chosen runtime allows it.
• Verify checksums before loading and provide a complete remove action.
• Report unsupported hardware and out-of-memory conditions clearly.
• Allow model loading and inference to be cancelled safely.
• Never switch to a remote API automatically.

Acceptance criteria

• A small health check can run fully offline after setup.
• Model state survives restart without duplicating files.
• Resource limits and model paths are covered by tests.
• Privacy behavior is documented in the app and repository.