feat: pin keychain item ACLs to the app's code signature (macOS)

After every keychain write, replace the item's ACL with an explicit
SecAccess whose trusted-application list is this app's code-signature
requirement (SecTrustedApplicationCreateFromPath(NULL)):

- New installs: items are ACL-pinned from the first save, so future
  upgrades never prompt (Developer ID requirement is stable).
- Upgraders from ad-hoc builds: the first access shows the standard
  one-time prompt; 'Always Allow' now permanently rewrites the ACL
  instead of just appending, so stale ad-hoc entries are cleaned up.
- Ref-only item lookup (kSecReturnRef) never prompts, and failures are
  swallowed so keychain writes never fail because of ACL work.

desktop/src-tauri/Cargo.toml

@@ -49,3 +49,12 @@ rustls-pemfile = "2"
 rustls-pki-types = "1"
 rustls-native-certs = "0.7"
 
+# Keychain ACL normalization (explicit SecAccess on stored secrets so items
+# survive app re-signs without permission prompts) — macOS only.
+[target.'cfg(target_os = "macos")'.dependencies]
+security-framework = "3.7"
+security-framework-sys = "2.17"
+# core-foundation: CFString/CFArray/TCFType helpers for the SecAccess FFI
+# (already a transitive dep of security-framework; pinned to the same 0.10 line)
+core-foundation = "0.10"
+