fix(desktop): store Windows secrets per credential - #7416

Summary

• store each Windows secret in its own Credential Manager entry instead of one aggregate JSON blob
• verify every direct write with a fresh OS read before callers can remove inline fallback
• migrate legacy aggregate entries safely, make direct entries authoritative, and remove stale aggregate copies only after verified persistence
• extend reset/sign-out to discover, delete, and verify all known managed-agent credentials
• serialize Windows Credential Manager access to avoid concurrent read/write verification failures

Problem

Windows Credential Manager limits a credential blob to 2,560 bytes. Aggregating many managed-agent nsec values into one JSON credential exceeds that limit and forces secrets to remain inline.

Safety properties

• backend, write, read-back, or legacy-cleanup failure keeps the managed-agent inline fallback
• new Windows values are never added to the aggregate blob
• direct entries override legacy values
• deleting one direct credential preserves the others
• reset captures known agent credential names before app data is renamed and verifies their absence before completion
• macOS and Linux retain the aggregate-blob implementation

Test plan

• cargo fmt --manifest-path desktop/src-tauri/Cargo.toml -- --check
• cargo check --manifest-path desktop/src-tauri/Cargo.toml
• cargo test --manifest-path desktop/src-tauri/Cargo.toml --lib — 3,010 passed, 0 failed, 19 ignored
• cargo test --manifest-path desktop/src-tauri/Cargo.toml windows_ -- --ignored — 4 Windows Credential Manager tests passed
• repeated the parallel Windows group 10 consecutive times after reproducing a pre-fix concurrent read-back failure

The Windows integration coverage includes 40 independently stored nsec-shaped values, legacy migration, stale-legacy cleanup, delete-one isolation, and full-reset deletion.