fix(backend): defer keychain migration until manual user grant

This fixes the issue where the app forces a macOS system prompt for credential store access on first launch/update. Instead, the legacy token is safely preserved in the persistent JSON document and is now only forcefully migrated to the macOS keychain when the user manually hits 'Grant Access' in the UI modal.

src-tauri/src/lib.rs

@@ -3103,6 +3103,10 @@ fn grant_keychain_access(
     app_state: tauri::State<'_, AppState>,
 ) -> Result<PairingTokenHydration, String> {
     let mut connection = database.lock()?;
+    
+    // Explicitly force migration of any legacy token to the keychain
+    let _ = crate::db::sanitize_current_settings_and_restore_token(&connection, true);
+    
     match crate::db::hydrate_pairing_token(&mut connection, false) {
         Ok((token, token_changed)) => {
             // Update the extension server's token in memory