Let people turn the operation log off (no undo while it's off), for the CRA #458

Why

The EU Cyber Resilience Act (Annex I, Part I, (2)(l)) asks that recording of internal activity, including modification of data, comes "with an opt-out mechanism for the user". The operation log (apps/desktop/src-tauri/src/operation_log/CLAUDE.md) journals every file mutation and has retention choices, but no "off". Split out of #456 (the security event log), which has its own, separate switch.

Proposed design

• New registry entry operationLog.enabled, type: 'boolean', default: true, component: 'switch', in the existing "Operation log" card (Settings › Behavior › Navigation & file ops, apps/desktop/src/lib/settings/definitions/behavior.ts). Its description says plainly that undo needs it. Follow docs/guides/adding-a-new-setting.md.
• When off: no journal is installed (operation_log::set_journal isn't called, or a no-op journal is), so new operations aren't recorded and can't be undone. Existing history stays readable, and retention keeps pruning it.
• Switching it on again resumes journaling from that moment; switching it off mid-operation must not break the running operation's undo record (decide: finish journaling operations already started, recommended).
• The history dialog says why it's empty or stops at a point when recording is off.
• Separate from securityLog.enabled (Keep a local security event log (AI consent, MCP, policy, updates, refused signatures) with an opt-out, for the CRA #456) on purpose: one protects undo, the other is the security record.
• Consider mcpSettable: an MCP client turning off the operation log would hide what it does next. Recommendation: mcpSettable: false, same as Keep a local security event log (AI consent, MCP, policy, updates, refused signatures) with an opt-out, for the CRA #456.

This is data-safety-adjacent (undo eligibility). Read operation_log/CLAUDE.md + DETAILS.md and docs/design-principles.md first.

Acceptance criteria

1. With the switch off, new operations aren't journaled and aren't offered for undo; with it on again, journaling resumes.
2. An operation already running when the switch flips keeps a consistent record (fully journaled or not at all, never half).
3. Existing history stays readable while off, and retention still prunes it.
4. The history dialog explains the gap or the empty state.
5. MCP can't change the setting.
6. Docs: operation_log/DETAILS.md, docs/security.md § Operation log, the CRA line on /trust if it describes the operation log.

Test plan (TDD: these first, see them fail)

1. With the flag off, an operation writes no journal rows (the TestJournalGuard pattern).
2. Flipping the flag mid-operation leaves a consistent record.
3. Undo isn't offered for an operation that ran while off.
4. Frontend: the switch renders in the Operation log card, mcpSettable is false, and the history dialog shows the explanation.

i18n

English strings only, each with a good @key description; the translator agent does the rest (docs/guides/i18n-translation.md).