fix(backend): absolutely eliminate keychain access on startup

This entirely removes 'sanitize_current_settings_and_restore_token' from 'db::init' and removes the keychain hydration from 'setup()'. The backend will now never access the keychain during bootstrapping, relying purely on the frontend to explicitly trigger token hydration and migration via Tauri IPC when the UI mounts. This guarantees the macOS system prompt will never block the app from opening, and will only appear after the window is fully visible.

src-tauri/src/db.rs

@@ -76,15 +76,14 @@ fn init_at_path_internal(app_data_dir: &Path, force_disable_keychain: bool) -> R
         backup_database(&connection, &database_path, &format!("schema-v{version}"))?;
     }
     migrate_schema(&mut connection, version)?;
-    let (current_token_pending, keychain_granted) =
-        sanitize_current_settings_and_restore_token(&connection, false)?;
-        
-    let allow_keychain = keychain_granted && !force_disable_keychain;
 
+    // We no longer touch the keychain on backend startup.
+    // Legacy imports will safely preserve any pairing token in the JSON payload.
+    // The frontend will manually trigger migration to the keychain via IPC if access is granted.
     import_legacy_data(
         &mut connection,
         app_data_dir,
-        allow_keychain && !current_token_pending,
+        false,
     )?;
 
     Ok(DbState {

src-tauri/src/lib.rs

@@ -3900,22 +3900,14 @@ pub fn run() {
             let database = crate::db::init(app.handle())
                 .map_err(|error| format!("failed to initialize persistence: {error}"))?;
             let initial_pairing_token = {
-                let mut connection = database.lock()?;
-                let skip_keychain = !crate::db::is_keychain_access_granted(&connection).unwrap_or(false);
-                match crate::db::hydrate_pairing_token(&mut connection, skip_keychain) {
-                    Ok((token, _)) => token,
-                    Err(error) => {
-                        log::warn!(
-                            "Secure credential storage unavailable; using session-only extension token: {}",
-                            error
-                        );
-                        format!(
-                            "{}{}",
-                            uuid::Uuid::new_v4().simple(),
-                            uuid::Uuid::new_v4().simple()
-                        )
-                    }
-                }
+                // Generate a temporary session token for the extension server on startup.
+                // The frontend will hydrate the real token via IPC once it mounts, 
+                // avoiding any macOS system prompts before the UI is fully visible.
+                format!(
+                    "{}{}",
+                    uuid::Uuid::new_v4().simple(),
+                    uuid::Uuid::new_v4().simple()
+                )
             };
             {
                 let mut pairing_token = extension_pairing_token