fix(security): add safeStorage fallback for production builds (#38) (#43)

Summary
  - Replace hard keytar dependency with a multi-strategy key storage:
    1) safeStorage (Electron built-in) — preferred
    2) keytar (system keychain) — fallback
    3) file-based encryption — last resort
  - Dynamically import keytar to avoid asar load failures
  - Refactor cloudHandler to use const (clean code)
  - Fix “Failed to load cloud accounts” in packaged app

  Rationale
  The keytar native module can fail to load from asar archives in production builds. This ensures the app works even when system keychain access is unavailable.

  Additional changes
  - Replace sync file ops with async (fs/promises)
  - Add atomic file writes to prevent data races
  - Implement concurrency lock for key generation
  - Add security error codes for better diagnostics
  - Add warnings for file-based fallback mode
  - Align error handling after merge
  - Migrate legacy encrypted account data

  References
  - Issue: #38
  - Commit: 92dc2f6

src/localization/i18n.ts

@@ -42,6 +42,11 @@ i18n
                 'Keychain access denied. The app may be unsigned; see README for the self-signing workaround.',
               signNotarize: 'Please use a signed and notarized build when available.',
             },
+            dataMigrationFailed: 'Unable to decrypt legacy account data.',
+            dataMigrationHint: {
+              relogin: 'Please re-login or re-add your accounts.',
+              clearData: 'If the issue persists, clear local account data and sign in again.',
+            },
           },
           nav: {
             accounts: 'Accounts',
@@ -222,6 +227,9 @@ i18n
             list: {
               noAccounts: 'No cloud accounts added yet.',
             },
+            error: {
+              loadFailed: 'Failed to load cloud accounts.',
+            },
             toast: {
               syncSuccess: {
                 title: 'Sync Successful',
@@ -324,6 +332,11 @@ i18n
               keychainDenied: 'Keychain 访问被拒绝。应用可能未签名，可参考 README 的“macOS 自签”说明。',
               signNotarize: '请在可用时使用已签名并公证的版本。',
             },
+            dataMigrationFailed: '旧版账号数据无法解密。',
+            dataMigrationHint: {
+              relogin: '请重新登录或重新添加账号。',
+              clearData: '如仍失败，请清理本地账号数据后再登录。',
+            },
           },
           nav: {
             accounts: '账号',
@@ -502,6 +515,9 @@ i18n
             list: {
               noAccounts: '暂无云账号。',
             },
+            error: {
+              loadFailed: '加载云账号失败。',
+            },
             toast: {
               syncSuccess: {
                 title: '同步成功',