feat: pin keychain item ACLs to the app's code signature (macOS)

After every keychain write, replace the item's ACL with an explicit
SecAccess whose trusted-application list is this app's code-signature
requirement (SecTrustedApplicationCreateFromPath(NULL)):

- New installs: items are ACL-pinned from the first save, so future
  upgrades never prompt (Developer ID requirement is stable).
- Upgraders from ad-hoc builds: the first access shows the standard
  one-time prompt; 'Always Allow' now permanently rewrites the ACL
  instead of just appending, so stale ad-hoc entries are cleaned up.
- Ref-only item lookup (kSecReturnRef) never prompts, and failures are
  swallowed so keychain writes never fail because of ACL work.

desktop/src-tauri/Cargo.lock

@@ -1787,6 +1787,7 @@ version = "0.7.13"
 dependencies = [
  "bytes",
  "chrono",
+ "core-foundation 0.10.1",
  "deadpool-postgres",
  "indexmap 2.14.0",
  "redis",
@@ -1795,6 +1796,8 @@ dependencies = [
  "rustls-native-certs",
  "rustls-pemfile 2.2.0",
  "rustls-pki-types",
+ "security-framework 3.7.0",
+ "security-framework-sys",
  "serde",
  "serde_json",
  "sqlx",