fix(security): purge credentials from settings backups

Write the newly protected settings payload to both sync and async config backups so disabling credential persistence or losing encryption availability cannot leave previously stored provider secrets behind.

Replace content-based prefix detection with a typed, versioned safeStorage envelope, preserve arbitrary legacy plaintext for migration, and emit field-only diagnostics for encryption failures without exposing credentials or ciphertext. Add regression coverage for both save paths, both persistence-off conditions, and prefix-shaped plaintext values.

tests/credential-protection.test.ts

@@ -1,5 +1,6 @@
-import { beforeEach, describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { defaultSettings } from "../src/main/constants";
+import { logger } from "../src/main/logger";
 import {
   configureCredentialProtector,
   CredentialProtector,
@@ -21,6 +22,10 @@ describe("credential protection", () => {
     configureCredentialProtector(createProtector());
   });
 
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
   it("protects remembered provider values and restores them for the main process", () => {
     const input = {
       ...defaultSettings(),
@@ -53,6 +58,53 @@ describe("credential protection", () => {
     expect(protectPersistedSettings(restorePersistedSettings(input)).token).not.toBe(input.token);
   });
 
+  it("protects plaintext credentials that begin with the legacy marker text", () => {
+    const input = {
+      ...defaultSettings(),
+      rememberToken: true,
+      token: "mdd-safe-storage:v1:literal-credential"
+    };
+
+    const persisted = protectPersistedSettings(input);
+
+    expect(persisted.token).not.toBe(input.token);
+    expect(JSON.stringify(persisted)).not.toContain(input.token);
+    expect(restorePersistedSettings(persisted).token).toBe(input.token);
+  });
+
+  it("reports encryption failures without logging credential data", () => {
+    const value = "credential-value-not-for-logs";
+    const warn = vi.spyOn(logger, "warn").mockImplementation(() => {});
+    configureCredentialProtector({
+      isEncryptionAvailable: () => true,
+      encryptString: () => { throw new Error("encryption failed"); },
+      decryptString: () => ""
+    });
+
+    const persisted = protectPersistedSettings({ ...defaultSettings(), token: value });
+
+    expect(persisted.token).toBe("");
+    expect(warn).toHaveBeenCalledWith("Credential-Verschlüsselung fehlgeschlagen: token");
+    expect(JSON.stringify(warn.mock.calls)).not.toContain(value);
+  });
+
+  it("reports decryption failures without logging persisted data", () => {
+    const persisted = protectPersistedSettings({ ...defaultSettings(), token: "value-to-encrypt" });
+    const serialized = JSON.stringify(persisted.token);
+    const warn = vi.spyOn(logger, "warn").mockImplementation(() => {});
+    configureCredentialProtector({
+      isEncryptionAvailable: () => true,
+      encryptString: () => Buffer.alloc(0),
+      decryptString: () => { throw new Error("decryption failed"); }
+    });
+
+    const restored = restorePersistedSettings(persisted);
+
+    expect(restored.token).toBe("");
+    expect(warn).toHaveBeenCalledWith("Credential-Entschlüsselung fehlgeschlagen: token");
+    expect(JSON.stringify(warn.mock.calls)).not.toContain(serialized);
+  });
+
   it("does not persist provider values when encryption is unavailable", () => {
     configureCredentialProtector(createProtector(false));
     const persisted = protectPersistedSettings({