P0-08: FundingCAPTCHA restart wipes captcha-settings.local.json (bug) #186

Part of #175 (audit Phase 0). Evidence: docs/audit/2026-11-09/detail/fundingcaptcha.md §2 "Dead members", §7.

Bug. ShowControl/FundingCAPTCHA/app.py:551, inside _do_restart(), calls _save_local({}), which writes {} to captcha-settings.local.json. That file is the per-host settings override: load_settings() (app.py:82-84) reads and shallow-merges it at boot. _save_local is the only writer in the tree. So any per-host override is destroyed the first time an operator presses R or hits /api/restart. It is a leftover from corner-calibration persistence (ADR-0012) that ADR-0013 did not remove when it deleted the CORNER_CAL state.

Do.

• Delete _save_local (app.py:90-91) and its call at :551.
• Add a test for the restart path (there are none): write a non-empty local file, trigger restart, assert the file is byte-identical.
• Fix docs/FundingCAPTCHA.md:93, which says the file is "not gitignored". It is (.gitignore:19).

Done when. Restart leaves the local file untouched and a test proves it.