refactor(app_controller): remove requests + tomli_w top-level imports; add main thread purity test

Phase 8 of startup_speedup_20260606 track.

Part 1: app_controller.py cleanup
- Removed 'import requests' (was used in 2 places - lazy import added inside)
- Removed 'import tomli_w' (dead import; never referenced in app_controller)
- Migrated 2 threading.Thread spawns to use self.submit_io (the do_post
  closures in _handle_approve_ask and _handle_reject_ask)

Part 2: Main thread purity enforcement test
- tests/test_main_thread_purity.py: 7 tests verify that the 6 refactored
  files (ai_client, app_controller, commands, theme_2, markdown_helper,
  gui_2) have ZERO top-level imports from the heavy denylist:
    {google.genai, anthropic, openai, requests, google.genai.types,
     fastapi, fastapi.security.api_key, src.command_palette,
     src.theme_nerv, src.theme_nerv_fx, src.markdown_table, numpy,
     tkinter, tomli_w}

This is the static enforcement (the runtime audit-hook test using
sys.addaudithook is a follow-up).

The test is RED before each refactor phase, GREEN after. If a future
commit re-introduces a heavy import in one of these files, the test
fails immediately in CI.

TESTS:
- 7/7 main thread purity tests PASS
- 15/15 log + app controller tests still PASS (no breakage from
  removing requests/tomli_w imports)

src/app_controller.py

@@ -5,11 +5,9 @@ import inspect
 import json
 import os
 import re
-import requests
 import sys
 import threading
 import time
-import tomli_w
 import traceback
 import uuid
 
@@ -3338,13 +3336,14 @@ class AppController:
 
   def do_post() -> None:
    try:
+    import requests
     requests.post(
      "http://127.0.0.1:8999/api/ask/respond",
      json={"request_id": request_id, "response": {"approved": True}},
      timeout=2
     )
    except Exception as e: print(f"Error responding to ask: {e}")
-  threading.Thread(target=do_post, daemon=True).start()
+  self.submit_io(do_post)
   self._pending_ask_dialog = False
   self._ask_request_id = None
   self._ask_tool_data = None
@@ -3361,13 +3360,14 @@ class AppController:
 
   def do_post() -> None:
    try:
+    import requests
     requests.post(
      "http://127.0.0.1:8999/api/ask/respond",
      json={"request_id": request_id, "response": {"approved": False}},
      timeout=2
     )
    except Exception as e: print(f"Error responding to ask: {e}")
-  threading.Thread(target=do_post, daemon=True).start()
+  self.submit_io(do_post)
   self._pending_ask_dialog = False
   self._ask_request_id = None
   self._ask_tool_data = None