Add official Apple Ads search popularity

[hubab1]

What changed

• replace keyword popularity refreshes with Apple’s official AppleAdsClient Swift package and Search Term Popularity endpoint
• add guided Apple Ads Platform credential verification, account selection, and local .env support for development
• add Apple Ads workspace views for Search Popularity, campaigns, and owned apps
• expose Apple Ads status, capabilities, apps, campaigns, and Search Term Popularity through MCP without accepting or returning secrets
• persist official 1–100 popularity into the existing keyword popularity column, keep sorting active during refresh, and hide invalid legacy scores when Apple returns no eligible row
• cache Apple’s threshold-based “unavailable” result for the normal seven-day freshness window while continuing to retry genuine failures
• fix generated campaign date decoding and account-selection load races

Why

The prior browser-session approach was not the same dataset and was unreliable. This change moves production popularity refreshes to Apple’s supported API/client and makes the source and unavailable-state semantics explicit.

Apple only returns Search Term Popularity rows that meet its reporting thresholds. Missing eligible rows are therefore treated as unavailable rather than authentication failures or stale valid scores.

Validation

• xcodebuild test ... — 684 tests in 60 suites passed
• clean Debug build passed
• unsigned universal Release build passed for arm64 and x86_64
• migrated an isolated copy of the 2.3 GB production database from the v0.4.2 schema to V6: 7,980 crawls and 1,468,674 facts matched exactly; 8,314 tracked snapshots processed; 7,980 links and 1,946 recovered crawls; zero legacy rows remain; SQLite quick_check returned ok
• in the final app build, refreshed the production-copy Flighty workspace through the UI: flight tracker changed from stale popularity 61 to fresh popularity 60, persisted with source appleAdsPopularity and no status error

Security and privacy

• private key remains in macOS Keychain for saved UI credentials
• MCP never accepts or returns credentials
• development credentials and the private-key file are ignored local files; no real credential identifier, path, or key material is included in this diff