Add optional AI application insights

[ZheLZZ]

What changed

• Add optional OpenAI-compatible application descriptions with an explicit main-window toggle. Turning it on refreshes descriptions; turning it off cancels the current request and restores compact rows.
• Send the current application list in one bounded, streamed request, with tolerant JSON/SSE parsing, response-size limits, timeouts, caching, and safe local fallbacks.
• Add an AI settings window with endpoint examples, connection testing, model selection, and credentials stored only in Windows Credential Manager.
• Keep model output informational: it cannot alter local scores, recommendations, selections, protection rules, or close behavior.
• Improve close handling for user-confirmed applications that still show CPU or I/O activity, while retaining the final identity, foreground-window, and modal-dialog safety checks.
• Replace repeated startup error dialogs with a single visible failure and clean exit.
• Update the README preview to the current AI-enabled interface and prepare version 0.2.0-beta.

Why

The earlier implementation treated connection success and generation success as the same contract, parsed some streamed responses as oversized plain text, and issued smaller per-item requests that were more likely to time out. The UI also expanded every row without a convenient way to collapse AI details. Separately, the close path could reject a user-confirmed application solely because it remained active, even after the user explicitly chose to close it.

This change separates connectivity from structured-generation validation, analyzes the bounded list as one streamed batch, makes the feature opt-in and collapsible, and preserves local safety rules as the only authority for closing applications.

Safety and privacy

• AI remains disabled by default and remote endpoints require HTTPS plus explicit consent.
• API keys are not stored in source, settings, SQLite, logs, URLs, cache keys, or request bodies.
• Requests exclude paths, PIDs, usernames, window titles, command lines, file contents, and other user content.
• Model output is treated as untrusted display text and cannot initiate a close operation.
• Exact comparison against the locally stored credential found 0 matches in candidate repository files.

Validation

• Release build: 0 warnings, 0 errors.
• Automated tests: 139 passed (Core 47, Persistence 14, Windows integration 27, AI 51).
• Final self-contained win-x64 publish contains version 0.2.0-beta and no PDB files.
• Release ZIP is extracted and verified file-by-file against the publish directory before upload.