security: migrate macOS pairing tokens to Keychain

[enaboapps]

Closes #657

Changes

• use the existing pairing Keychain service on macOS as well as Windows
• migrate and verify legacy plaintext tokens before deleting their entries and empty file
• preserve availability by using the legacy token when Keychain access or migration fails, then retry on later loads
• write new pairings only to secure storage and clear both stores on forget

Validation

• npm run lint, npm test, npm run build, npm audit
• app Rust fmt, Clippy, and 223 tests
• verifier and startup-launcher fmt, Clippy, tests, and all Cargo audits
• unsigned Windows UIAccess installer rebuild and structural verification