fix: cache third-party keychain data to eliminate repeated password prompts

[kargnas]

Summary

• Cache browser encryption keys (Chrome/Brave/Arc/Edge Safe Storage), Claude Code credentials, and Copilot CLI tokens in app-owned keychain items after the first successful read
• App-owned keychain items use Developer ID-based ACL which persists across app updates, unlike third-party items whose partition_id resets on token refresh
• Wire 401/403 error handling in ClaudeProvider and CopilotProvider to invalidate both persistent keychain cache and in-memory cache, enabling automatic recovery on next fetch cycle

Problem

macOS prompts for keychain password daily because:

1. Third-party keychain items (Chrome Safe Storage, Claude Code, Copilot CLI) use partition_id ACL which resets when the original app refreshes tokens
2. After app updates via Sparkle, the binary hash changes and macOS re-evaluates trust for third-party items

Solution

Cache-first strategy: Read third-party keychain once → cache in our own keychain → all subsequent reads use cache (no prompt). Self-healing when keys/tokens change:

Access Point	File	Cache Key
Browser Safe Storage	BrowserCookieService.swift	com.copilotmonitor.BrowserEncryptionKeyCache
Claude Code credentials	TokenManager.swift	com.copilotmonitor.KeychainDataCache
Copilot CLI accounts	TokenManager.swift	com.copilotmonitor.KeychainDataCache

Cache invalidation paths

• Browser key rotation: Detects decryption failure → compares fresh key with cached → only re-prompts if key actually changed
• Claude 401: ClaudeProvider calls invalidateClaudeKeychainCaches() → clears persistent + memory cache
• Copilot 401/403: CopilotProvider calls invalidateCopilotKeychainCaches() → clears persistent + memory cache
• Cache parse failure: readKeychainJSON falls through to original keychain if cached data can't be parsed

Changed Files

• BrowserCookieService.swift — Encryption key cache layer with stale-key detection
• TokenManager.swift — Keychain data cache helpers, Copilot CLI account serialization cache, invalidation methods
• ClaudeProvider.swift — Invalidate Claude keychain cache on 401
• CopilotProvider.swift — Invalidate Copilot keychain cache on 401/403