perf: stop per-frame SQLite writes and console spam, make perf.log opt-in

- Explorer: the tip check runs every frame the Explorer tab is open,
  and it read both tip rows and rewrote them each time (two autocommit
  WAL writes per frame). A steady tip is now kept in memory and skips
  SQLite. A new tip writes both rows in one savepoint, so a crash
  between them can't pair a new height with the old hash. A test
  checks that 100 steady checks write nothing.
- Console: while the daemon was in the Error state the Console tab
  added its error line on every poll, i.e. every frame, re-laying out
  the whole buffer each time. It prints once per error now: on entering
  Error, when the message changes, or after another crash
  (EmbeddedDaemon::getUnexpectedExitCount(), never reset). setState
  writes the message before the state, so a reader that sees Error sees
  that error's message. The stray " ===" suffix is gone.
- perf.log: the profiler appended a block every 300 frames on every
  run and never rotated the file (tens of MB a day for a wallet left
  open). It is now off unless the app starts with DRAGONX_PERFLOG=1;
  otherwise its zone hooks are near no-ops.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/util/perf_log.h

@@ -31,6 +31,8 @@ namespace util {
  *
  * Every N frames (default 300 ≈ 5s at 60fps) it appends a summary block
  * to  <ObsidianDragonDir>/perf.log  with min/avg/max/p95 for each zone.
+ * Off unless the app is started with DRAGONX_PERFLOG=1 (main.cpp calls init() only then); every
+ * call below is a near no-op until init() succeeds.
  */
 class PerfLog {
 public:
@@ -78,7 +80,7 @@ public:
 
     /// Begin a named zone. Returns an opaque time point.
     std::chrono::steady_clock::time_point beginZone() {
-        return Clock::now();
+        return ready_ ? Clock::now() : Clock::time_point{};
     }
 
     /// End a named zone. Pass the time point from beginZone().