fix(backend): hydrate session token without triggering keychain prompts

This fixes a severe issue where 'hydrate_pairing_token' was hardcoded to fetch from the keychain on startup and via the 'hydrate_extension_pairing_token' command. This caused multiple macOS keychain prompts to appear back-to-back before the app even loaded. We now correctly check the user's 'keychainAccessGranted' preference from the DB payload and skip keychain operations entirely if they haven't explicitly granted access yet.

src-tauri/src/db.rs

@@ -549,6 +549,20 @@ pub fn load_settings(connection: &Connection) -> Result<Option<String>, String>
         .map_err(|error| format!("failed to load settings: {error}"))
 }
 
+pub fn is_keychain_access_granted(connection: &Connection) -> Result<bool, String> {
+    let Some(settings) = load_settings(connection)? else {
+        return Ok(false);
+    };
+    let document: Value = serde_json::from_str(&settings)
+        .map_err(|error| format!("failed to decode settings: {error}"))?;
+    let granted = document
+        .get("state")
+        .and_then(|s| s.get("keychainAccessGranted"))
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    Ok(granted)
+}
+
 pub fn save_settings(connection: &Connection, data: &str) -> Result<(), String> {
     connection
         .execute(