fix: default logs off, suppress webview context menu, sort queue rows, defer keychain access to user action

- Disable log capture by default in both backend (LOG_PAUSED=true) and
  frontend (isPaused=true) to avoid unnecessary disk I/O and battery drain.
- Add a global contextmenu listener that prevents the webview's default
  right-click menu (Reload, etc.) so the app behaves like a native macOS
  window. Custom context menus in DownloadItem, LogsView, and Sidebar
  still work because their handlers preventDefault() before the document
  listener fires.
- Sort the download table by queuePosition when viewing a specific queue
  so the move-up/down controls produce a visible reorder instead of a
  silent position swap with no UI feedback.
- Rework the keychain access flow to eliminate the OS credential prompt
  that appeared before the app's own KeychainPermissionModal after every
  binary update. hydrate_extension_pairing_token now always skips the
  keychain; only the explicit Grant Access button (grant_keychain_access)
  triggers the OS prompt, which is user-initiated and therefore acceptable
  even when macOS trust resets after a code-signature change.

src/main.tsx

@@ -45,3 +45,11 @@ if (rootElement) {
     </StrictMode>,
   );
 }
+
+// Prevent the webview's default context menu ("Reload", etc.) on right-click.
+// Individual components that provide custom context menus call preventDefault()
+// in their own onContextMenu handlers, which fires before this document-level
+// listener and is unaffected.
+document.addEventListener('contextmenu', (e) => {
+  e.preventDefault();
+});