fix(ui): harden keychain grants and window controls

Keep native credential-store completion pending until the frontend accepts it, prevent stale grant races, and isolate blocking keyring work from the UI. Derive sidebar reveal spacing from each custom control style and restore neutral GNOME/minimal hover feedback.

src/utils/windowControlStyle.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { resolveWindowControlStyle } from './windowControlStyle';
+import { getWindowControlRevealOffset, resolveWindowControlStyle } from './windowControlStyle';
 
 describe('resolveWindowControlStyle', () => {
   it('uses the platform convention for automatic style', () => {
@@ -25,4 +25,11 @@ describe('resolveWindowControlStyle', () => {
     expect(resolveWindowControlStyle('gnome', 'macos')).toBe('gnome');
     expect(resolveWindowControlStyle('minimal', 'windows')).toBe('minimal');
   });
+
+  it('reserves space after the complete custom-control footprint', () => {
+    expect(getWindowControlRevealOffset('macos')).toBe(88);
+    expect(getWindowControlRevealOffset('windows')).toBe(168);
+    expect(getWindowControlRevealOffset('gnome')).toBe(134);
+    expect(getWindowControlRevealOffset('minimal')).toBe(104);
+  });
 });