feat(key-vault): encrypted API key vault with Touch ID unlock and paste-to-pane

[Juliusolsson05]

Motivation

Store named third-party API keys by user-created provider, avoiding repeated trips to provider dashboards. Depends on the shared insertion helper in #830.

Implemented Contract

• API Key Vault command opens provider/key management. Providers start empty; keys have name, value and note.
• Key values use per-key Electron safeStorage ciphertext. Names, notes and partial hints are plaintext metadata; short values have no hint that would expose the whole secret.
• First vault access per app launch attempts the macOS user-presence prompt. No biometric-only capability prefilter. Cancellation fails closed.
• Concurrent unlocks share one prompt. Lock revokes pending authentication/disk reads and broadcasts cache invalidation across windows. Insert always re-enters the main gate.
• Serialized CRUD, validated ids/indexes, unique exclusive temporary files and 0600 permissions. Damaged/future indexes are preserved and mutations refuse rather than replacing them with an empty vault.
• Reveal, clipboard copy, insert into the captured pane, and {{key:Provider/Key}} template references. Resolve ordinary variables before key references at final insertion; preserve unrelated source-code braces.

Explicit Protection Boundary

Encryption protects key values stored in the vault, not the downstream prompt pipeline. Inserted values follow ordinary plaintext draft autosave, terminal scrollback and provider transcript retention; copying places plaintext on the system clipboard. The modal and control reference disclose this. Names/notes should not contain secrets. Remote/MCP secret access, export/import and transparent secret-token drafts are out of scope.

Acceptance Criteria

• CRUD, per-key encryption and short-hint policy.
• Single-flight authentication and cancellation-safe lock fencing with regression tests.
• Cross-window reveal-cache invalidation and failed-edit retention covered in UI tests.
• Mixed variable/key templates and verbatim zero-variable content covered by tests.
• Typecheck, focused tests and desktop/remote build pass.
• PR CI and manual password/Touch ID/terminal smoke verification.

Verification

Branch feat/api-key-vault. Initial Claude and Codex reviews requested changes; follow-up fixes and regression tests are included. Latest focused set: 89 tests across 12 files. Full-suite execution timed out and is not claimed green. Real OS authentication on password-only hardware remains a manual verification gap.

[Juliusolsson05]

Implemented in #840. Final Claude and Codex MCP-orchestrated review verdicts: APPROVE after lock/read revocation, cross-window cache invalidation, storage, template and terminal fixes. Rebased verification: 142 tests across 19 focused files plus typecheck. Vault-only at-rest protection and plaintext downstream retention are explicitly disclosed. CI and manual OS authentication checks remain visible in the PR.