Implement versioned settings, layout, cache, log, and secret boundaries

[zoeyrose]

Outcome

Give client state safe platform paths, atomic persistence, migrations, scoped reset, and privacy-conscious retention.

Scope and invariants

• Separate portable preferences, semantic UI layout, per-server identity/trust, per-character presentation, authenticated resource cache, logs, screenshots, crash data, and credentials/secrets.
• Define versioned schemas/migrations, atomic write/rename/fsync policy, lock/concurrent-instance behavior, corruption recovery, defaults, and forward-incompatible handling.
• Use platform-correct directories and permissions with optional portable mode explicitly isolated.
• Provide reset-by-domain and inspect/export diagnostics without deleting unrelated data.
• Bound sizes/retention and redact secrets/private content according to user choices.

Acceptance criteria

• Fault tests cover malformed/old/new files, interrupted/full-disk writes, permissions, concurrent instances, server identity changes, cache corruption, and reset of every domain.
• /resetwidgets replacement resets only layout/widget state and can undo/recover where practical.
• Chat logs and crash reports obey configured privacy/retention and never contain tokens/passwords.
• Uninstall/reinstall/upgrade behavior is documented and tested on Linux/Windows.
• Headless config tests require no SDL/GPU.

Dependencies and parallelization

Supports existing #25/#26 and login/resource issues. Each subsystem owns its schema but uses this common storage/migration layer.

Licensing

Client code/tests are MIT. Legacy reuse requires an audited approved-grantor grant; all other implementation is independent. Content, sound, and graphics retain their exact asset licenses and notices.