Managed/enterprise mode: org policy to disable destructive identity actions in the desktop app

## Context

We run a self-hosted Buzz relay for a company whose members are mostly non-technical. Identity is a raw Nostr keypair, which we handle org-side with key escrow at onboarding (IT vaults every nsec before first use, phones are paired as a second copy via NIP-AB).

## Problem

Settings → Profile ends with a red **"Delete my data"** button that removes the identity key and all local app data. For a business deployment this is a one-click footgun: a non-technical user can destroy the only local copy of their key. Escrow makes it recoverable for us, but most orgs will not have that discipline, and there is no way to reduce the blast radius in-app.

Checking the v0.5.5 desktop source, there appear to be no managed-config/policy hooks at all — nothing an org can ship to tame destructive UI for its fleet.

## Ask

A managed mode for the desktop, driven by an org-deployable policy file (analogous to managed settings in other desktop software, e.g. a read-only file in a system path that MDM can place), supporting at minimum:

- hide or gate destructive actions ("Delete my data", possibly raw key reveal)
- require the key-backup step to be completed during onboarding (no skip)

This would make Buzz deployable to non-technical workforces without forking the app. Happy to help spec or contribute this.