fix(ui): align action controls and protect keychain consent

src/utils/keychainStartup.test.ts

@@ -1,7 +1,32 @@
 import { describe, expect, it } from 'vitest';
-import { getKeychainConsentVersion, getKeychainStartupDecision } from './keychainStartup';
+import {
+  getKeychainAccessReady,
+  getKeychainConsentVersion,
+  getKeychainStartupDecision
+} from './keychainStartup';
 
 describe('getKeychainStartupDecision', () => {
+  it('keeps portable site credentials gated until system-store access is granted', () => {
+    expect(getKeychainAccessReady({
+      portable: true,
+      accessGranted: false,
+      persistent: true
+    })).toBe(false);
+    expect(getKeychainAccessReady({
+      portable: true,
+      accessGranted: true,
+      persistent: true
+    })).toBe(true);
+  });
+
+  it('uses persistent pairing state for standard-mode readiness', () => {
+    expect(getKeychainAccessReady({
+      portable: false,
+      accessGranted: false,
+      persistent: true
+    })).toBe(true);
+  });
+
   it('changes the consent identity when the credential-access policy changes', () => {
     expect(getKeychainConsentVersion('1.1.0')).toMatch(
       /^1\.1\.0\|(build-.+|keychain-policy-2)$/

src/utils/keychainStartup.ts

@@ -11,6 +11,12 @@ export type KeychainStartupDecision = {
   showKeychainPrompt: boolean;
 };
 
+export type KeychainAccessReadiness = {
+  portable: boolean;
+  accessGranted: boolean;
+  persistent: boolean;
+};
+
 // The semantic app version can remain unchanged across release-candidate and
 // packaging rebuilds. Use the build identity so an updated binary cannot skip
 // Firelink's explanation and invoke the OS prompt directly. The policy epoch
@@ -30,6 +36,13 @@ export const getKeychainConsentVersion = (appVersion: string): string => {
     : '';
 };
 
+export const getKeychainAccessReady = ({
+  portable,
+  accessGranted,
+  persistent
+}: KeychainAccessReadiness): boolean =>
+  portable ? accessGranted : persistent;
+
 export const getKeychainStartupDecision = ({
   portable,
   appVersion,