feat: configure and request LocalStats with remote-admin PKI #1340

Context

protobufs#1023 adds device-owned request policies for LocalStats and requested DeviceMetrics. Firmware enforcement is firmware#11247.

Owner settings

• Add LocalStats Shared channel / Remote admins only to device Security configuration.
• Add a separate DeviceMetrics Shared channel / Remote admins only control, but enable its remote-admin choice only while Device telemetry broadcast is disabled. Explain why it is unavailable while broadcasting.
• Both controls write device configuration, not browser-local state, and verify persistence after reconnect. Do not show the remote-admin choice as effective until supported firmware reads it back.

Remote request flow

• Never add NodeInfo/capability advertising or background probe traffic for these policies.
• An attached client LocalStats refresh stays local and needs no transport choice.
• Every user-initiated remote LocalStats or DeviceMetrics refresh opens a web dialog: Shared channel or Remote admin (PKI). Explain that PKI only succeeds for configured remote admins.
• Add a purpose-built SDK request API. Shared channel uses the target channel; Remote admin uses TELEMETRY_APP, target public key, and explicit PKI fields. Never reuse the legacy admin sender. Disable PKI when the target public key is unavailable.
• Never auto-retry or fall back between methods. The selected request is the only radio transmission.
• Render Routing_Error.NOT_AUTHORIZED as an explicit result. A channel NAK can offer a user-initiated switch to PKI; a PKI NAK explains that this identity is not a configured remote admin. A timeout remains No response, not an authorization verdict.

Packet tests and evidence

Add SDK/UI tests for a non-zero target channel, PKI request fields, no legacy-admin fallback, attached/local path, NOT_AUTHORIZED request-ID correlation, and no automatic retry. Attach a real-device packet/log capture plus web screenshots for: owner LocalStats setting, owner DeviceMetrics setting with broadcast disabled, request-method dialog, selected Shared channel request, selected PKI request, LocalStats noise floor, authorized response, and NOT_AUTHORIZED state. Include browser and build.