feat(security): encrypt stored credentials at rest with keychain-backed master key

[sunxiaobin89]

Summary

Encrypts connection secrets (SSH password, key passphrase, proxy password, VNC password) at rest. Previously these were stored in plaintext in the app's WebView localStorage; the export feature also wrote them into shareable files.

Approach

Single app-level master key + AES-256-GCM:

• A random 32-byte master key is generated on first use and stored in the OS keychain (Rust keyring crate, one entry for the whole app → one authorization prompt, never per-credential).
• Secrets are persisted as v1:<b64 nonce>:<b64 ciphertext>. Plaintext only exists in memory transiently at connect time — never written to localStorage.
• persistConnections() is the single write path and strips any non-v1: plaintext secret as a defensive layer.
• Startup migration seals legacy plaintext already in storage (keeps the plaintext copy on failure so the only copy is never destroyed).
• Edit dialog never echoes a stored secret: the field stays empty with a hint ("leave blank to keep the saved password"); blank = keep stored, typed = replace.
• Export strips all secret fields (plaintext and ciphertext) from shared config bundles.

Verification

• 636 frontend tests + 152 Rust tests pass.
• tsc --noEmit clean; i18n key parity (en/zh-CN) holds.
• Manual test of save / edit / connect / reconnect / migration round-tripped end to end.

Fixes #100

[sunxiaobin89]

@GOODBOY008 Friendly ping on this one — happy to adjust or rebase as needed. 🙂

One thing I noticed: since this PR was opened, main gained SSH tunnel / jump-host support (#79), which introduces a new credential field (tunnel password). If the overall approach here looks acceptable, I'd suggest including that field in the encryption scope as well — I'm happy to fold it in together with the rebase onto the latest main.

[sunxiaobin89]

Rebased onto the latest main (v2.9.0) — the conflicts with the new quit-guard commands and the SSH tunnel tab are resolved.

While rebasing, I also folded the new SSH tunnel (jump host) fields from #79 into the encryption scope: tunnelPassword and tunnelPassphrase are now sealed like the other secrets, never echoed back in the edit dialog, and stripped from exported configs. Any legacy plaintext tunnel credentials migrate on startup together with the other secret fields.

Verification: 718 frontend tests + 170 Rust tests pass; tsc --noEmit, cargo clippy and i18n key parity are clean.

[sunxiaobin89]

Rebased again onto main to pick up #125 (passwordless hosts) and #103 (default SSH key path). The credential checks now follow the new passwordless semantics — blank passwords and empty key paths stay valid, while the stored-secret "keep on blank" behavior of this PR is unchanged. openConnectionSecrets runs before the shared connectionHasCredentials check so restore-time decisions see decrypted values.

Verification: 732 frontend tests + 177 Rust tests pass; tsc --noEmit and i18n key parity are clean.