refactor(src): migrate last two String-typed Tauri commands to AppError

[saagpatel]

Summary

Final cleanup for ADR 0012. A post-session audit caught two #[tauri::command] functions that slipped through every prior migration PR because they don't fit any domain file:

• get_allow_unverified_local_models (was Result<bool, String>)
• set_allow_unverified_local_models (was Result<(), String>)

Both live in commands/mod.rs directly and are registered via registry.rs:66 / :76. The unverified-model settings flag they control is a global security toggle, not a domain concern — which is why they weren't bundled with any of the domain migrations.

Changes

• get_allow_unverified_local_models bridges its still-String internal helper allow_unverified_local_models via .map_err(AppError::internal). The helper stays on String because it's also called by an unregistered dead-code load_custom_model wrapper in mod.rs (shadow of model_commands::load_custom_model) that would cascade otherwise.
• set_allow_unverified_local_models: full migration → db_lock_failed / db_not_initialized / db_query_failed.

Verification

Ran across src-tauri/src/commands/*.rs:

awk '/^#\[tauri::command\]/ { flag=1 } flag && /^pub (async )?fn/ {
  check Result<_, String>; flag=0 }'

Zero String-returning #[tauri::command] functions remain. ADR 0012 is now truly complete.

Test plan

• cargo check --all-targets — clean
• cargo test --lib — 311 pass, 1 ignored
• cargo test --test command_contracts — 8 pass

🤖 Generated with Claude Code