fix: default logs off, suppress webview context menu, sort queue rows, defer keychain access to user action

- Disable log capture by default in both backend (LOG_PAUSED=true) and
  frontend (isPaused=true) to avoid unnecessary disk I/O and battery drain.
- Add a global contextmenu listener that prevents the webview's default
  right-click menu (Reload, etc.) so the app behaves like a native macOS
  window. Custom context menus in DownloadItem, LogsView, and Sidebar
  still work because their handlers preventDefault() before the document
  listener fires.
- Sort the download table by queuePosition when viewing a specific queue
  so the move-up/down controls produce a visible reorder instead of a
  silent position swap with no UI feedback.
- Rework the keychain access flow to eliminate the OS credential prompt
  that appeared before the app's own KeychainPermissionModal after every
  binary update. hydrate_extension_pairing_token now always skips the
  keychain; only the explicit Grant Access button (grant_keychain_access)
  triggers the OS prompt, which is user-initiated and therefore acceptable
  even when macOS trust resets after a code-signature change.

src/store/useSettingsStore.ts

@@ -179,7 +179,7 @@ const generateSecureToken = () => {
 
 export const useSettingsStore = create<SettingsState>()(
   persist(
-    (set, get) => ({
+    (set, _get) => ({
       theme: 'system',
       baseDownloadFolder: '~/Downloads',
       categorySubfolders: { ...DEFAULT_CATEGORY_SUBFOLDERS },
@@ -316,8 +316,10 @@ export const useSettingsStore = create<SettingsState>()(
         set({ extensionPairingToken: token });
       },
       hydratePairingToken: async () => {
-        const granted = get().keychainAccessGranted;
-        const result = await invoke(granted ? 'grant_keychain_access' : 'hydrate_extension_pairing_token');
+        // Always use the safe hydration path that never touches the OS keychain
+        // on its own.  The modal will be shown when needed and only the explicit
+        // "Grant Access" action (→ grant_keychain_access) triggers the OS prompt.
+        const result = await invoke('hydrate_extension_pairing_token');
         set({ 
           extensionPairingToken: result.token,
           isPairingTokenPersistent: result.persistent