feat: configure LocalStats request privacy and PKI remote refresh

[RCGV1]

Context

protobufs#1023 adds device-owned request policies for LocalStats and requested DeviceMetrics. Firmware enforcement is firmware#11247.

Owner settings

• In Security configuration, expose LocalStats Shared channel / Remote admins only.
• Expose DeviceMetrics Shared channel / Remote admins only separately, but only enable its remote-admin choice while Device telemetry broadcast is disabled. Explain why it is unavailable while broadcast is enabled.
• Both controls write the device config, not client-local state, and verify persistence after reconnect. Do not show the remote-admin choice as effective until supported firmware reads it back.

Remote request flow

• Never add NodeInfo/capability advertising or background probe traffic for these policies.
• A directly attached LocalStats refresh remains local and needs no transport choice.
• Every user-initiated remote LocalStats or DeviceMetrics refresh opens a native Compose sheet: Shared channel or Remote admin (PKI). Explain that PKI only succeeds for configured remote admins.
• Shared channel uses the target node's actual channel index. Remote admin uses TELEMETRY_APP, the destination public key, and PKI routing primitive; never fall back to the legacy admin channel. Disable PKI when the target public key is unavailable.
• Never auto-retry or fall back between methods. The selected request is the only radio transmission.
• Render Routing_Error.NOT_AUTHORIZED as an explicit result. A channel NAK can offer a user-initiated switch to PKI; a PKI NAK explains that this identity is not a configured remote admin. A timeout remains No response, not an authorization verdict.

Packet tests and evidence

Add packet-contract tests for a non-zero target channel, PKI fields, no legacy-admin fallback, attached/local path, NOT_AUTHORIZED request-ID correlation, and no automatic retry. Attach a real-device packet/log capture plus Android screenshots for: owner LocalStats setting, owner DeviceMetrics setting with broadcast disabled, request-method sheet, selected Shared channel request, selected PKI request, LocalStats noise floor, authorized response, and NOT_AUTHORIZED state. Include emulator/device and build.