Continue PR #142: security + Nix docs follow-up (#148)

* feat: add Nix Flake release and update documentation for Nix integration

- Added flake.nix with native library patching for Linux
- Included SHA256 hashes for v0.10.0 DEB releases (x86_64 and arm64)
- Updated README.md with instructions for nix run, NixOS, Home Manager, and devShells
- Generated flake.lock for reproducibility

* refactor: improve Nix Flake patterns for better consumer control

- Extracted derivation logic into a reusable `mkPackage` function
- Exposed `overlays.default` to allow consumers to use their own nixpkgs instance
- Updated `pkgs.system` to `pkgs.stdenv.hostPlatform.system` to follow modern Nix patterns
- Ensured default `packages` definition correctly handles unfree configuration for testing with `nix build` or `nix run`

* docs: update README with advanced Nix integration patterns

- Added Option 1 (Direct Integration) and Option 2 (Overlay) documentation
- Explained how to use the overlay for full nixpkgs control
- Fixed Markdown styling and lint issues in the Nix integration section

* docs: simplify Nix documentation to favor Overlay integration

- Removed "Option 1" (direct integration) as per user feedback
- Promoted the Overlay method as the standard way to consume the package
- Updated devShell examples to rely on the overlayed package set for consistency

* fix(security): prevent master key overwriting on decryption failure and improve account loading resilience

- Modify readSafeStorageKey and generatePrimaryMasterKey to stop if decryption fails for an existing file, preventing permanent data loss when keyring is temporarily locked.
- Update CloudAccountRepo.getAccounts and getAccount to gracefully skip corrupted account records instead of throwing errors.
- Added detailed logging for security failures to aid in diagnostics.

* docs(readme): sync Nix/NixOS integration docs in README.zh-CN

---------

Co-authored-by: Youssef <[email protected]>

src/ipc/database/cloudHandler.ts

@@ -638,21 +638,41 @@ export class CloudAccountRepo {
         return undefined;
       }
 
-      const tokenResult = await decryptAndMigrateField(
-        orm,
-        normalizedRow.id,
-        'tokenJson',
-        normalizedRow.tokenJson,
-      );
-      const quotaResult = await decryptAndMigrateField(
-        orm,
-        normalizedRow.id,
-        'quotaJson',
-        normalizedRow.quotaJson,
-      );
+      let tokenResult: DecryptFieldResult;
+      try {
+        tokenResult = await decryptAndMigrateField(
+          orm,
+          normalizedRow.id,
+          'tokenJson',
+          normalizedRow.tokenJson,
+        );
+      } catch (error) {
+        logger.error(
+          `[CloudAccountRepo] getAccount ${id} failed - Decryption failed for token`,
+          error,
+        );
+        return undefined;
+      }
 
-      if (!tokenResult.value) {
-        throw new Error(`Missing token data for account ${normalizedRow.id}`);
+      let quotaResult: DecryptFieldResult;
+      try {
+        quotaResult = await decryptAndMigrateField(
+          orm,
+          normalizedRow.id,
+          'quotaJson',
+          normalizedRow.quotaJson,
+        );
+      } catch (error) {
+        logger.error(
+          `[CloudAccountRepo] getAccount ${id} failed - Decryption failed for quota`,
+          error,
+        );
+        quotaResult = { value: null, migrated: false };
+      }
+
+      const tokenValue = tokenResult.value;
+      if (!tokenValue) {
+        return undefined;
       }
 
       return {