feat(sqlite): ask the browser not to evict a browser database

[pal-tamas]

Summary

Rask.SQLite.Browser keeps its snapshots in IndexedDB, and IndexedDB is evictable. Under storage
pressure a browser may discard them, and the database comes back empty on the next load with nothing to
indicate why — the app looks like it lost the user's data, and nothing in it can say otherwise.

#645 landed IStorageEstimator.RequestPersistAsync(), so the
owning tab can now ask for the origin to be exempted from eviction.

builder.Services.AddRaskBrowserSqlite("app");                        // asks by default
builder.Services.AddRaskBrowserSqlite("app", o => o.RequestPersistentStorage = false);  // or don't

Decisions worth reviewing

• IsPersistedAsync() is checked before asking, so an origin that is already exempt is never asked a
  second time — which matters on the browsers that prompt.
• A refusal never fails the boot. It is logged and changes nothing else; the app runs exactly as it did
  before, the risk simply stops being silent. One log branch, not two: RequestPersistAsync resolves
  false both when the browser declines and when it has no such API, and from the caller's side those have
  the same consequence.
• Only the owning tab asks. The others persist nothing, so a prompt there would buy the user nothing.
• RequestPersistentStorage defaults to true, because a silently evictable database is a worse
  default than a request. It is an option for a real reason though: Chromium decides from engagement
  heuristics without prompting, whereas Firefox shows a permission prompt — and this is asked during
  boot rather than from a click. An app that would rather choose its moment sets it to false and calls
  IStorageEstimator.RequestPersistAsync() from a user-gesture handler.

Testing

• 48/48 in Rask.SQLite.Browser.Tests (6 new): asks once; never asks when already persisted; never asks
  in a non-owner tab; never asks when disabled; still boots and restores when declined; still boots when
  the interop throws.
• dotnet format clean, dotnet build Rask.slnx -warnaserror clean.
• Full local browser E2E gate and CLI build gate passed on push.
• No benchmarks: nothing here touches the render hot path.

Follow-ups (not in this PR)

• The ranged-flush seam — IOriginPrivateFileSystem.WriteAsync now exists, so an offset+length interface
  can be designed against something real, with per-page hashes as the diff baseline rather than a shadow
  copy.
• Multi-tab promotion, still documented as unimplemented.