Fix local OAuth secret-store key generation for packaged installs

[omer-second]

Summary

• Route local-install OAuth secret storage to a stable per-user secrets directory instead of the app working directory
• Validate regenerated keys before use and create the directory with restrictive permissions
• Allow packaged local installs to skip the production encryption-key requirement when the local-install flag is set
• Pass the secrets directory through the bundled CLI launcher so the web app and local runtime agree on storage location

Testing

• Not run (not requested)