fix: persist auth state in electron storage

[jonathanlab]

We need to store our auth and refresh token somewhere else than in local storage. We temporarily put it there because the safe storage prompt was annoying in dev.

This PR makes its so it's instead stored encrypted in application support in renderer-store.json.

The encryption key is derived from node-machine-id which returns a stable hardware UUID.

Format is like so.

  {
    "v": 1, // we could bump this if needed.
    "iv": "<random 16 bytes, base64>",
    "data": "<ciphertext, base64>",
    "tag": "<auth tag, base64>"
  }

If someone has file access on your machine, they can derive the same key. But if an attacker has that level of access, the user has bigger problems. The encryption primarily prevents token theft via cloud sync/backups/similar cases.

[wiz-7ad640923b]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	2  1
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Total	2  1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.