fix(ios): confirm Safe Mode writes before data-grid row saves and inserts

[datlechin]

Problem

On iOS, a connection's Safe Mode set to "Confirm Writes" is not enforced for data-grid edits. Editing a row in the row detail view and saving runs the UPDATE with no confirmation; inserting a row via the insert sheet does the same. The SQL query editor already prompts. Read-Only correctly blocks editing; only Confirm Writes was broken for grid writes.

Root cause

The three-way Safe Mode decision (block / confirm / proceed) was re-implemented ad-hoc at each write site. QueryEditorView did it correctly; the grid sites (RowDetailViewModel.saveChanges, InsertRowView.insertRow) only checked the read-only half and skipped requiresConfirmation. InsertRowView wasn't even passed safeModeLevel.

Fix

Centralize the decision so no write path can skip it, then apply it at the grid sites:

• SafeModeLevel gains a WritePermission enum and a writePermission computed var (in the TableProModels package, unit-tested).
• RowDetailViewModel.saveChanges() consults writePermission; when confirmation is required it defers (sets pendingWriteConfirmation, stashes the SQL) instead of executing. executePendingSave() runs it after the user confirms.
• RowDetailView and InsertRowView present a SwiftUI .alert with a destructive confirm button and an explicit Cancel, naming the table.
• DataBrowserView passes connection.safeModeLevel into the insert sheet.
• QueryEditorView swaps its inline chain for switch writePermission (behavior-preserving), removing the last ad-hoc copy.

DELETE is unchanged: it already shows a confirmation dialog for every connection, so a second prompt would double-confirm.

Design notes

• Uses .alert, not .confirmationDialog: alerts render identically on iPhone and iPad and always show an explicit Cancel. confirmationDialog becomes a popover on iPad (regular size class) with no guaranteed Cancel row, which is wrong for a data-changing confirmation.
• The alert message names the operation and table; no raw SQL (it can't render in an alert body, and a long statement would break layout on a phone).

Tests

• New TableProModelsTests/SafeModeLevelTests.swift: writePermission for all three levels. swift test passes.
• RowDetailViewModelTests: confirmWrites defers and runs no query; executePendingSave() then runs the UPDATE.

Notes

• swiftformat could not run locally: the repo .swiftformat uses --ifdefindent, which the installed swiftformat version rejects. Pre-existing and unrelated to this change.