feat(tools): withdraw tip and tour when the user switches them off

Off should mean the model is never told the tool exists. A switch that
only made the call fail leaves Hermes offering walkthroughs it cannot
give and promising to point at things it cannot point at, which reads as
a broken agent rather than a respected preference.

Both gate on the switch through a shared desktop_ui.user_enabled helper,
which is the reactions check_fn generalized — same config read, same
reason it has to be config rather than an env var: the switch belongs to
the session's client, and the client may be on another machine.

tools/tip_tool.py

@@ -10,12 +10,11 @@ sentence.
 Fire-and-forget, unlike ``tour``: a tip is not a question, so blocking the turn
 on a round-trip would stall the reply it belongs to.
 
-Ungated, also like ``tour``. The desktop's Settings → Appearance switch governs
-the app's own idle rotation — the half that talks unprompted — not this, which
-Hermes raises mid-conversation in answer to something the user said.
-
 Lives in the ``desktop_ui`` toolset, which the GUI gateway enables only for
-desktop-sourced sessions.
+desktop-sourced sessions, and withdraws itself entirely when the user has
+turned tips off (Settings → Appearance). Off means the model is never told the
+tool exists — a switch that only made the call fail would leave Hermes
+promising to point at things it cannot point at.
 """
 
 import json
@@ -95,6 +94,11 @@ TIP_SCHEMA = {
 }
 
 
+def check_tips_enabled() -> bool:
+    """The user's Settings → Appearance switch. On unless they turned it off."""
+    return desktop_ui.user_enabled("in_app_tips", default=True)
+
+
 registry.register(
     name="tip",
     toolset="desktop_ui",
@@ -105,5 +109,6 @@ registry.register(
         title=args.get("title", ""),
         side=args.get("side", ""),
     ),
+    check_fn=check_tips_enabled,
     emoji="💡",
 )