v0.23.4 - Credential storage hardening

Security

• Browser-cookie usage now defaults to manual mode, so provider refreshes do not read/decrypt browser cookie stores unless the user explicitly selects Automatic or imports cookies.
• Provider fetch contexts now respect manual/off cookie-source settings, reducing behavior-based antivirus triggers around DPAPI browser-cookie access.
• Local secret-bearing stores (settings.json, manual_cookies.json, api_keys.json, and token-accounts.json) now save through a secure-file wrapper. Windows saves are protected with DPAPI; existing plaintext files remain readable and are rewritten protected on the next save.
• Raw provider response snippets and browser cookie-store paths are no longer emitted in routine diagnostic logs.

Verification

• Rust unit tests passed locally.
• Tauri desktop tests/checks passed locally.
• Frontend production build passed locally.
• DPAPI secure-file round-trip was validated on Windows, including a check that protected files do not contain plaintext JSON.