feat: store post-processing API keys in OS keychain

[VirenMohindra]

Before Submitting This PR

Please confirm you have done the following:

• I have searched existing issues and pull requests (including closed ones) to ensure this isn't a duplicate
• I have read CONTRIBUTING.md

Human Written Description

• UI displays persisted keys without having to "re-enter" them
• API keys for post-processing providers are currently stored as plaintext in settings_store.json, which means any process with file read access can read them. this moves them into the OS-native credential store (macOS keychain, windows credential manager, linux secret service) so they're protected at rest. existing keys also get silently migrated on first launch and the UI now shows a masked hint instead of the full key

Related Issues/Discussions

• Fixes https://discord.com/channels/1391636091853078608/1395929320303890514/1471814960303570986
• ask: "Feature request on post-processing allow users to have multiple API providers and easily switch between them without re-entering the API key when switching back."
• securely stores keys instead of in a json file, with an initial migration kicked off at app start

Community Feedback

• https://discord.com/channels/1391636091853078608/1395929320303890514/1471814960303570986

Testing

• set an API key in the current version (plaintext in JSON), launch the updated version, verify settings_store.json no longer contains the key value
• verify the key is in macOS keychain (keychain access app -> search "com.handy.app")
• verify post-processing still works with the migrated key
• provider dropdown shows all providers
• switching to a provider with a saved key shows ••••••••xxxx
• clicking edit allows re-entering a key
• clicking clear removes the saved key
• switching providers and back retains the saved key
• enter a new API key, verify it shows masked after saving, verify post-processing works
• provider with no key shows empty input, post-processing gracefully skips
• bun run lint and cargo clippy pass

Screenshots/Videos (if applicable)

persisted-key	empty placeholder	navigating back to persisted key

AI Assistance

• No AI was used in this PR
• AI was used (please describe below)

If AI was used:

• Tools used: Claude Code
• How extensively: full implementation from approved plan, with extensive testing