fix(ui): harden keychain grants and window controls

Keep native credential-store completion pending until the frontend accepts it, prevent stale grant races, and isolate blocking keyring work from the UI. Derive sidebar reveal spacing from each custom control style and restore neutral GNOME/minimal hover feedback.

src/utils/windowControlStyle.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { resolveWindowControlStyle } from './windowControlStyle';
+import { getWindowControlRevealOffset, resolveWindowControlStyle } from './windowControlStyle';
 
 describe('resolveWindowControlStyle', () => {
   it('uses the platform convention for automatic style', () => {
@@ -25,4 +25,11 @@ describe('resolveWindowControlStyle', () => {
     expect(resolveWindowControlStyle('gnome', 'macos')).toBe('gnome');
     expect(resolveWindowControlStyle('minimal', 'windows')).toBe('minimal');
   });
+
+  it('reserves space after the complete custom-control footprint', () => {
+    expect(getWindowControlRevealOffset('macos')).toBe(88);
+    expect(getWindowControlRevealOffset('windows')).toBe(168);
+    expect(getWindowControlRevealOffset('gnome')).toBe(134);
+    expect(getWindowControlRevealOffset('minimal')).toBe(104);
+  });
 });

src/utils/windowControlStyle.ts

@@ -2,6 +2,19 @@ import type { WindowControlStyle } from '../bindings/WindowControlStyle';
 
 export type ResolvedWindowControlStyle = Exclude<WindowControlStyle, 'auto'>;
 
+// The reveal button sits after the complete custom-control hit area. Keep this
+// derived from the resolved style so a sidebar toggle can never overlap a
+// platform-specific control footprint.
+const WINDOW_CONTROL_REVEAL_OFFSETS: Record<ResolvedWindowControlStyle, number> = {
+  macos: 88,
+  windows: 168,
+  gnome: 134,
+  minimal: 104,
+};
+
+export const getWindowControlRevealOffset = (style: ResolvedWindowControlStyle): number =>
+  WINDOW_CONTROL_REVEAL_OFFSETS[style];
+
 export const resolveWindowControlStyle = (
   style: WindowControlStyle,
   os: string,