feat(desktop): first-run onboarding wizard with safeStorage

[hqhq1025]

Goal

Ship the 3-step first-run onboarding flow described in
docs/research/06-api-onboarding-ux.md so a new user can paste an API key,
see it validated live against the provider's /v1/models, pick default
models, and land in chat — all in under 90 seconds — without ever leaving
plaintext credentials on disk.

What's in

• Welcome step — path picker (Try free / Use my key / Ollama placeholder)
• Paste-key step — auto-detect provider by prefix, 500ms-debounce live
  validation against /v1/models for Anthropic, OpenAI, OpenRouter (one
  fetch per provider, Anthropic uses anthropic-version: 2023-06-01).
  Specific 401 / 402 / 429 / network error messages with a "How to get a
  key" link.
• Choose-models step — hardcoded shortlist per provider with sensible
  defaults.
• safeStorage keychain wrapper — encrypts the pasted key, stores
  base64 ciphertext only.
• @iarna/toml config I/O — ~/.config/open-codesign/config.toml
  (XDG-aware, mode 0600). Parsed through a Zod ConfigSchema — malformed
  files throw CONFIG_* errors, never silent fallback.
• IPC: onboarding:get-state, onboarding:validate-key,
  onboarding:save-key, onboarding:skip. The renderer no longer ships an
  apiKey in codesign:generate; main pulls the key from the keychain
  per-call so the renderer never holds long-lived plaintext.
• Vitest coverage for pingProvider (200 / 401 / 402 / 429 / network /
  custom baseUrl / unsupported provider / empty key).
• docs/CONFIG.md documenting every key, file location, security model
  and reset procedure.

Not in (out of scope, future PRs)

• Ollama auto-detection (Phase 0.2)
• Browser OAuth for Anthropic (Phase 0.4)
• "More providers" expander beyond tier-1 three (Phase 0.3)
• UX shell components, Settings page, theme toggle (owned by wt/preview-ux)
• Streaming generation pipeline changes (packages/runtime, core,
  exporters, artifacts, templates not touched)

Hard rules respected

• No silent fallbacks — every failure throws a CodesignError with a
  structured code (e.g. PROVIDER_NOT_SUPPORTED, KEYCHAIN_UNAVAILABLE,
  CONFIG_PARSE_FAILED, CONFIG_SCHEMA_INVALID) and the renderer surfaces
  the message verbatim.
• All UI uses var(--color-*) tokens — no hardcoded hex / px / fonts.
  Button from @open-codesign/ui handles all primary actions.
• TypeScript strict + verbatimModuleSyntax — import type for types,
  bracket notation for index access, no any.
• DCO sign-off on the commit.

New deps (license + size)

Package	Version	License	Approx install size
@iarna/toml	^2.2.5	ISC (Apache-2.0 compatible)	~70 KB unpacked, zero deps

Within the ≤80 MB installer budget and ≤30-prod-deps budget (now 8/30 in apps/desktop).

Acceptance test outcomes

Repo-level checks (run from worktree root):

pnpm install            ok
pnpm -r typecheck       ok (10 packages green)
pnpm lint               ok (2 pre-existing/cosmetic warnings, exit 0)
pnpm -r test            ok (9 new validate tests pass; 17 total)

Manual flow (described — Electron not run inside CI):

1. rm -rf ~/.config/open-codesign && pnpm --filter @open-codesign/desktop dev
2. Welcome screen renders with three path buttons (Ollama disabled).
3. Paste sk-ant-… → within ~500 ms shows
   "Recognized: Anthropic Claude — Connected (N models)".
4. Bad key → red AlertCircle line with the specific 401 message and the
   "How to get a key" link to console.anthropic.com/settings/keys.
5. Finish wizard → app re-renders into chat. Kill app, restart → lands
   directly in chat (config + ciphertext on disk).
6. cat ~/.config/open-codesign/config.toml shows base64 ciphertext under
   [secrets.anthropic].ciphertext, never the original key.

Screenshots

Not attached (no Electron screenshot tooling in this branch). The wizard
renders inside a 28rem max-width card centred on the existing
var(--color-background) surface, using the same Sparkles brand mark and
warm-beige token palette as the chat shell. Each step shows a "Step N of 3"
counter top-right.