fix(csp): allow loopback HTTP for the local AI provider; enable AI Assistant by default

Real end-to-end verification (Playwright-driven real Electron app on this
Mac, against the actual local Ollama instance, not a mock) found the actual
blocker: production's connect-src CSP (`'self' https: wss:`) rejects plain
http:// entirely, so lib/ai/local-client.ts's loopback fetch to Ollama never
even attempted the network in a production build - Electron or browser
alike. This is almost certainly what looked like a browser-sandbox network
issue in the earlier (non-Electron) QA pass tonight too.

Fix is narrow, not a blanket http: relaxation: connect-src now additionally
allows `http://127.0.0.1:*` and `http://localhost:*` specifically. Loopback
has no network hop, so it doesn't reopen the mixed-content-style downgrade
risk the existing https-only production policy guards against - unlike
dev's blanket `http:` allowance, which stays dev-only.

Confirmed fixed: rebuilt (build:standalone + build:electron), launched the
real Electron app via Playwright's _electron, and got a genuine answer back
from the real local Ollama - "Test connection" showed Reachable (the real
success state, not the CORS-diagnostic fallback text), and asking "Reply
with exactly the words: LOCAL AI WORKS" returned exactly that, with the
correct "no local mail index in this session" banner alongside it (accurate
for a fresh Electron session with nothing synced yet).

Also flips FeatureGates.aiAssistantEnabled's default false->true: local now
genuinely works and ships free/unmetered (see lib/ai/types.ts), so there is
a real feature behind the tab, not an empty preview - matches tonight's
explicit "I want AI visible" instruction. An admin can still turn it off.

Verified: typecheck clean, lint clean (0 errors, pre-existing warnings
only), translations pass (48/48), full production build succeeds.

lib/admin/types.ts

@@ -68,10 +68,10 @@ export interface FeatureGates {
   unifiedCrossAccountEnabled: boolean;
   /**
    * Master admin switch for the AI Assistant tab (docs/AI-ASSISTANT-CONCEPT.md).
-   * Defaults false, like pluginsEnabled — unlike every other gate, this one
-   * fronts a feature with no licensed provider class behind it yet (P1/P2 of
-   * that doc's phased rollout), so an admin opts in explicitly rather than
-   * every existing install suddenly showing a tab that does nothing.
+   * Defaults true as of the 2026-08-05 evening decision to make local AI
+   * visible by default (see lib/ai/types.ts) — local ships free with no
+   * entitlement gate, so there's a real, working feature behind this tab
+   * now, not an empty preview. An admin can still turn it off per-tenant.
    */
   aiAssistantEnabled: boolean;
 }
@@ -100,7 +100,7 @@ export const DEFAULT_FEATURE_GATES: FeatureGates = {
   crossStarredViewEnabled: false,
   crossAllViewEnabled: false,
   unifiedCrossAccountEnabled: false,
-  aiAssistantEnabled: false,
+  aiAssistantEnabled: true,
 };
 
 export interface ThemePolicy {