docs: update outdated status claims (encryption, syncing, architecture, privacy)

[0xbrayo]

Updates pages that describe features as planned or in progress when they have since landed, and documents behavior changes coming in v0.14.

security.rst, "Encrypting data": this described encryption only as an idea. aw-server-rust now has opt-in SQLCipher encryption at rest (aw-server-rust#584): build with the encryption/encryption-vendored feature, then pass the key with AW_DB_PASSWORD or --db-password. Release builds don't include it, and the section now says so.

features/syncing.rst: said syncing is "currently being worked on" and "not yet implemented in a stable release", which contradicted syncing.rst (aw-sync shipped in v0.13.0). It now points to the syncing page and clearly labels the old prototype section as historical.

syncing.rst (v0.14): the aw-sync daemon is now push-only by default; pulling needs pull = true in aw-sync/config.toml (aw-server-rust#716). The one-shot aw-sync sync command still pulls and pushes.

architecture.rst:

• Adds aw-tauri (the experimental Tauri distribution offered from v0.14) to the user interfaces.
• Drops "a JavaScript client is on the way" and the "beta"/"work in progress" labels. aw-client-js is used by aw-webui and aw-watcher-web; aw-client-rust is used by aw-sync.
• aw-analysis was described as planned; that repo is now aw-research, which exists and is active.

privacy.rst (v0.14): the v0.14 web UI adds an optional AI Summary page (aw-webui#948) that, once the user enters their own OpenAI/Anthropic API key, sends a derived activity overview (app names, domains, category names, hostnames, time totals; no titles, full URLs, or event timestamps) directly from the browser to that provider. The policy said ActivityWatch never transmits data externally, so this adds a section disclosing it. Since this page is also the Play Store privacy policy, please review the wording.

The v0.14 items describe behavior in the current v0.14 betas; v0.13.2 is still the latest stable release. Happy to hold those parts until v0.14 is final if preferred.

Not included: the changelog still stops at v0.11.0 (v0.12/v0.13 are missing). That needs the changelog generation script run and is better as its own PR.