test(crypto): keychain coverage with mocked keytar + optional macOS E2E

[h4yfans]

Closes Phase 1 §1.5 of .claude/plans/tech-debt-remediation.md.

Summary

Dedicated coverage for keychain.ts (55L) via mocked keytar unit tests, plus an env-gated real-keychain E2E for manual macOS smoke.

New files

• keychain.test.ts — 17 tests covering storeKey, retrieveKey, deleteKey, MEMRY_DEVICE account suffix branch, error wrapping (Error + non-Error throwables), null/empty-string falsy guard in retrieve, deletePassword=false idempotency, end-to-end store↔retrieve roundtrip across all KEYCHAIN_ENTRIES.
• keychain.e2e.test.ts — env-gated (KEYCHAIN_E2E=1) real-keychain roundtrip; skipped by default in CI.

Coverage targets (hand-review)

All 3 functions exercised; all 3 try/catch branches exercised; both err instanceof Error ternary branches exercised; both resolveAccount branches exercised; if (!encoded) return null exercised twice (null + empty string). Should yield 100% line + branch + function coverage.

Test plan

• pnpm --filter desktop test --project main src/main/crypto/keychain.test.ts — 0 failures (E2E skipped by default)
• per-file coverage on keychain.ts ≥ 95%
• pnpm typecheck:node && pnpm typecheck:web clean
• pnpm lint clean
• (optional, local only) KEYCHAIN_E2E=1 pnpm ... keychain.e2e.test.ts on macOS

🤖 Generated with Claude Code