Gamify: E-P6 privacy, settings, consent & offline correctness

[fernandotonon]

Part of #796 — Gamify: editor half. Cross-cuts E-P1..E-P5.

Goal

Make the whole feature privacy-respecting, transparent, and correct when logged-out/offline — a prerequisite for shipping telemetry from a desktop tool that handles proprietary assets.

Work

• Preferences pane (new section in settings): explains exactly what's shared (feature keys, counts, numeric before/after metrics — never asset content), with toggles:
  • Master: "Sync my QtMesh progress" (on/off).
  • Sub-toggles: feature-usage telemetry, operations history.
  • "What is shared?" expandable with a concrete example payload.
  • "Delete my gamification data" → calls a cloud endpoint to purge stats/achievements/operations (coordinate with cloud epic).
• Offline/logged-out correctness: nothing emitted logged-out; queue holds while offline; graceful when the cloud is unreachable.
• First-run consent: the first time an event would be sent, a one-time, non-blocking prompt to enable/keep-off (default off until acknowledged, to be safe for a tool handling client assets).

Acceptance criteria

• A settings pane clearly lists what is/ isn't shared, with a real example payload.
• Master + per-stream opt-outs fully stop the corresponding emission.
• "Delete my gamification data" purges server-side and clears local queue/cache.
• First-run consent prompt shown once; default is off until acknowledged.
• Verified: logged-out and opt-out states produce zero network calls for gamification.

Guardrail

• This is a professional tool used on proprietary/NDA assets. When in doubt, share less. Content never leaves the machine except via the explicit upload flow the user already controls.