feat: implement native OS keyring for site logins

- Replaced plaintext local storage password fields with keyring v3 OS native integration.
- Tauri backend securely sets, gets, and deletes credentials via system keychains.
- Dynamic password injection occurs seamlessly on download start and metadata parsing.

apps/desktop/src/components/AddDownloadsModal.tsx

@@ -326,12 +326,20 @@ export const AddDownloadsModal = () => {
             const { mediaCookieSource } = settingsStore;
             const browserArg = mediaCookieSource !== 'none' ? mediaCookieSource : null;
             const login = getSiteLogin(url, settingsStore);
+            let keychainPassword = null;
+            if (login) {
+              try {
+                keychainPassword = await invoke<string>('get_keychain_password', { id: login.id });
+              } catch (e) {
+                console.warn("Could not fetch keychain password:", e);
+              }
+            }
 
             const jsonStr = await invoke<string>('fetch_media_metadata', { 
               url, 
               cookieBrowser: browserArg,
               username: login?.username || null,
-              password: login?.password || null
+              password: keychainPassword
             });
             const mediaData = parseMediaFormats(jsonStr);
             if (mediaData && mediaData.formats.length > 0) {
@@ -351,10 +359,18 @@ export const AddDownloadsModal = () => {
           } else {
             const settingsStore = useSettingsStore.getState();
             const login = getSiteLogin(url, settingsStore);
+            let keychainPassword = null;
+            if (login) {
+              try {
+                keychainPassword = await invoke<string>('get_keychain_password', { id: login.id });
+              } catch (e) {
+                console.warn("Could not fetch keychain password:", e);
+              }
+            }
             const meta = await invoke<{filename: string, size: string, size_bytes: number}>('fetch_metadata', { 
               url,
               username: login?.username || null,
-              password: login?.password || null
+              password: keychainPassword
             });
             updatedItems[i] = { url, file: meta.filename, size: meta.size, sizeBytes: meta.size_bytes, status: 'Ready' };
           }

apps/desktop/src/components/SettingsView.tsx

@@ -116,17 +116,27 @@ export default function SettingsView() {
     }
   };
 
-  const handleAddLogin = () => {
+  const handleAddLogin = async () => {
     if (!loginPattern.trim() || !loginUser.trim()) {
       setLoginError("Please enter a URL pattern and a username.");
       return;
     }
     const id = crypto.randomUUID();
+    
+    if (loginPass) {
+      try {
+        await invoke('set_keychain_password', { id, password: loginPass });
+      } catch (e) {
+        console.error("Failed to save password to keychain:", e);
+        setLoginError("Failed to save password securely.");
+        return;
+      }
+    }
+
     settings.addSiteLogin({
       id,
       urlPattern: loginPattern.trim(),
-      username: loginUser.trim(),
-      password: loginPass
+      username: loginUser.trim()
     });
     setLoginPattern('');
     setLoginUser('');
@@ -534,7 +544,12 @@ export default function SettingsView() {
                         <p className="text-text-secondary text-xs">User: {login.username}</p>
                       </div>
                       <button
-                        onClick={() => {
+                        onClick={async () => {
+                          try {
+                            await invoke('delete_keychain_password', { id: login.id });
+                          } catch (e) {
+                            console.warn("Could not delete password from keychain:", e);
+                          }
                           settings.removeSiteLogin(login.id);
                           showToast("Deleted credential");
                         }}