Fix Rust backend: secrets to keychain, status recovery, shutdown, dedup

- Move git_token and Bedrock credentials to OS keychain instead of
  storing in plaintext projects.json via skip_serializing + keyring
- Fix project status stuck in Starting on container creation failure
  by resetting to Stopped on any error path
- Add granular store methods to reduce TOCTOU race window
- Add auth_mode, project path, and bedrock config change detection
  to container_needs_recreation with label-based fingerprinting
- Fix mutex held across async Docker API call in exec resize by
  cloning exec_id under lock then releasing before API call
- Add graceful shutdown via on_window_event to clean up exec sessions
- Extract compute_env_fingerprint and merge_claude_instructions helpers
  to eliminate code duplication in container.rs
- Remove unused thiserror dependency
- Return error instead of falling back to CWD when data dir unavailable

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/src-tauri/src/lib.rs

@@ -6,6 +6,7 @@ mod storage;
 use docker::exec::ExecSessionManager;
 use storage::projects_store::ProjectsStore;
 use storage::settings_store::SettingsStore;
+use tauri::Manager;
 
 pub struct AppState {
     pub projects_store: ProjectsStore,
@@ -21,10 +22,18 @@ pub fn run() {
         .plugin(tauri_plugin_dialog::init())
         .plugin(tauri_plugin_opener::init())
         .manage(AppState {
-            projects_store: ProjectsStore::new(),
-            settings_store: SettingsStore::new(),
+            projects_store: ProjectsStore::new().expect("Failed to initialize projects store"),
+            settings_store: SettingsStore::new().expect("Failed to initialize settings store"),
             exec_manager: ExecSessionManager::new(),
         })
+        .on_window_event(|window, event| {
+            if let tauri::WindowEvent::CloseRequested { .. } = event {
+                let state = window.state::<AppState>();
+                tauri::async_runtime::block_on(async {
+                    state.exec_manager.close_all_sessions().await;
+                });
+            }
+        })
         .invoke_handler(tauri::generate_handler![
             // Docker
             commands::docker_commands::check_docker,