fix(ios): keep connection Safe Mode across iCloud sync

[datlechin]

Problem

On iOS, a connection's Safe Mode does not survive relaunch. Set it to Confirm Writes, save, quit, reopen: it's back to Off.

Root cause

Safe Mode persists to disk fine, but iCloud sync (on by default) round-trips connections through CloudKit, and the iOS package's SyncRecordMapper never wrote or read safeModeLevel. On relaunch the pull rebuilds the connection with the field defaulted to .off; the connection is no longer dirty, so mergeConnections treats remote as newer, overwrites the saved .confirmWrites, and persists .off back to disk.

The macOS app already syncs safeModeLevel; only the iOS/package mapper dropped it. macOS and iOS keep separate DatabaseConnection/SafeModeLevel/SyncRecordMapper implementations and meet only at the CloudKit field names.

Fix

SyncRecordMapper now round-trips safeModeLevel:

• toRecord and updateRecord write the field.
• toConnection reads it via safeModeLevel(fromWire:isReadOnly:), which:
  • maps the iOS values (off/confirmWrites/readOnly) directly, which also covers macOS readOnly so write protection round-trips cross-device;
  • maps macOS-only values (silent -> .off, alert/safeMode variants -> .confirmWrites) so a connection protected on the Mac reads correctly on iPhone;
  • falls back to isReadOnly ? .readOnly : .off for legacy/absent records, matching DatabaseConnection's Codable decoder.

No macOS, model, or PluginKit-ABI changes. No new user-facing strings, so no localization or docs changes.

Tests

New TableProSyncTests target (none existed) with SyncRecordMapperTests:

• round-trip for every Safe Mode level
• updateRecord carries the new level
• legacy record without safeModeLevel falls back to isReadOnly
• macOS wire values decode to the nearest iOS level

swift test --filter SyncRecordMapperTests passes (13 cases).