feat: store host passwords in system keychain

[qfxiongbinbin]

Purpose

Move host passwords out of the SQLite database (plaintext) into the macOS Keychain, so credentials are no longer stored in cleartext on disk.

Changes

• Backend (src-tauri/src/main.rs)
  • Passwords stored in system Keychain (service ServerDeck, keyed by host id); DB keeps only a __serverdeck_keychain__ marker.
  • Idempotent migration on DB open moves existing plaintext passwords to the Keychain; failures leave rows untouched and retry next launch.
  • resolve_host_password resolves credentials from keychain at connect time (with legacy plaintext fallback).
  • New duplicate_host command copies the keychain-stored password to the duplicated host.
  • Save/delete host flows write/remove keychain entries; empty password on edit means "keep stored one".
• Frontend (src/lib/api.ts, src/App.tsx, src/lib/i18n.ts)
  • SavedHost.hasPassword flag; passwords are never sent to the UI.
  • Password field placeholder "Saved in Keychain — leave blank to keep" (en/zh/ja).
  • Duplicate host goes through the new backend command.

Validation

• tsc --noEmit ✅ / cargo check ✅
• Verified keychain entries exist for all migrated hosts and manual sshpass + ssh login succeeds with the keychain-stored password on multiple hosts.

Notes

• Hosts DB migrated by a dev build is incompatible with older app versions (they would send the marker string as the password). Running app must include this change.
• Branch is based on 0.0.32 while main is at 0.0.35 — Cargo.toml/Cargo.lock may need a merge with main before merging to avoid downgrading the version.