[Feature]: Reconsider the default for automatic device-asset downloads

### Problem / motivation

`auto_download_assets` defaults to true (`crates/openlogi-core/src/config/settings.rs:220-231`, `Default` at 463), and release builds ship without bundled art, so first launch fetches device renders on demand (`xtask/src/commands/macos/bundle.rs:74-88`). The fetch races three hosts, including a third-party CDN (`crates/openlogi-assets/src/source.rs:21-34`: assets.openlogi.org, a Cloudflare Pages mirror, cdn.jsdelivr.net), and request paths contain the device model (for example `v1/devices/mx_master_3s/front_core.png`), with the app version in the User-Agent.

Net effect: on a default install, the asset hosts learn the user's IP address and which Logitech models they own. No identifiers, cookies or payloads are sent, and files are SHA-256 checked against the index, but this sits oddly next to the local-first positioning, and the setting is not visible enough for users who care.

### Proposed solution

Any of these would help, in order of preference:

1. A first-run prompt for asset downloads, mirroring the update-check consent dialog.
2. Default `auto_download_assets` to false.
3. At minimum, a short privacy note in the README stating what is fetched, from where, and how to turn it off (`auto_download_assets = false`).

### Alternatives considered

Bundling assets in the installers avoids the network entirely but grows the download; on-demand with a prompt keeps both properties.

**Related areas:** GUI, Auto-update

Start by reading crates/openlogi-core/src/config/settings.rs:220-231 and the Default implementation at 463, then inspect xtask/src/commands/macos/bundle.rs:74-88 and crates/openlogi-assets/src/source.rs:21-34. The proposed approaches need maintainer agreement before work begins; done should mean the selected privacy behavior is implemented and its user-facing implications are verified.

Written by the indexing model from the issue text.