fix(security): redact secrets from plaintext persistence

- Strip password, cookies, and headers from download_queue before writing
  to store.bin; secrets remain in-memory for the active session only.
- Move extension pairing token from PersistedSettings to the OS keychain,
  rotating it on upgrade from versions that persisted it as plaintext.
- Add ignores_legacy_extension_pairing_token_field test to confirm serde
  silently drops the old field so existing installs migrate cleanly.
- Document intentional retention of URLs (signed params are the download
  source and cannot be redacted without breaking resume/retry).

src/App.tsx

@@ -67,6 +67,13 @@ function App() {
 
   useEffect(() => {
     useDownloadStore.getState().initDB();
+    // Hydrate the browser-extension pairing token from the OS keychain before
+    // the reactive push to the backend. If no token exists (fresh install or
+    // upgrade from a plaintext-persisting version) a new one is minted and
+    // stored, effectively rotating it away from any leaked plaintext.
+    useSettingsStore.getState().hydratePairingToken().catch(error => {
+      console.error('Failed to hydrate extension pairing token:', error);
+    });
   }, []);
 
   useEffect(() => {