fix(security): redact secrets from plaintext persistence

- Strip password, cookies, and headers from download_queue before writing
  to store.bin; secrets remain in-memory for the active session only.
- Move extension pairing token from PersistedSettings to the OS keychain,
  rotating it on upgrade from versions that persisted it as plaintext.
- Add ignores_legacy_extension_pairing_token_field test to confirm serde
  silently drops the old field so existing installs migrate cleanly.
- Document intentional retention of URLs (signed params are the download
  source and cannot be redacted without breaking resume/retry).

src-tauri/src/ipc.rs

@@ -237,7 +237,10 @@ pub struct PersistedSettings {
     pub media_cookie_source: MediaCookieSource,
     pub download_directories: HashMap<String, String>,
     pub site_logins: Vec<SiteLogin>,
-    pub extension_pairing_token: String,
+    // Note: `extension_pairing_token` is intentionally NOT persisted here. It
+    // is an HMAC shared secret and is stored in the OS keychain by the
+    // frontend. The field is kept on legacy persisted JSON only; serde ignores
+    // unknown fields when decoding, so existing installs migrate cleanly.
     pub auto_check_updates: bool,
 }