fix(security): harden credential and path boundaries

Preserve pending pairing tokens until credential-store migration succeeds, defer keychain access until frontend hydration, reject symlink and malformed ownership paths, and restrict metadata credentials to exact origins.

Refs #15

Refs #16

src-tauri/src/settings.rs

@@ -446,7 +446,6 @@ fn default_settings() -> PersistedSettings {
         prevents_sleep_while_downloading: true,
         media_cookie_source: MediaCookieSource::default(),
         site_logins: Vec::new(),
-        extension_pairing_token: String::new(),
         auto_check_updates: true,
         keychain_access_granted: false,
     }