fix(security): redact secrets from plaintext persistence

- Strip password, cookies, and headers from download_queue before writing
  to store.bin; secrets remain in-memory for the active session only.
- Move extension pairing token from PersistedSettings to the OS keychain,
  rotating it on upgrade from versions that persisted it as plaintext.
- Add ignores_legacy_extension_pairing_token_field test to confirm serde
  silently drops the old field so existing installs migrate cleanly.
- Document intentional retention of URLs (signed params are the download
  source and cannot be redacted without breaking resume/retry).

src/store/useDownloadStore.ts

@@ -11,7 +11,7 @@ import type { ExtensionDownload } from '../bindings/ExtensionDownload';
 import type { Queue } from '../bindings/Queue';
 import type { MediaMetadata } from '../bindings/MediaMetadata';
 import { useSettingsStore } from './useSettingsStore';
-import { isActiveDownloadStatus } from '../utils/downloads';
+import { isActiveDownloadStatus, redactDownloadForPersistence } from '../utils/downloads';
 
 export type { DownloadCategory } from '../utils/downloads';
 
@@ -628,13 +628,10 @@ useDownloadStore.subscribe(async (state, prevState) => {
   }
 
   if (state.downloads !== prevState.downloads) {
-    const staticDownloads = state.downloads.map(d => {
-      const copy = { ...d };
-      delete copy.fraction;
-      delete copy.speed;
-      delete copy.eta;
-      return copy;
-    });
+    // Strip secret fields (password/cookies/headers) and volatile progress
+    // before writing to disk. Secrets remain on the in-memory item for the
+    // active session only.
+    const staticDownloads = state.downloads.map(redactDownloadForPersistence);
     
     const currentSerialized = JSON.stringify(staticDownloads);
     if (currentSerialized !== lastSavedDownloads) {