fix(security): remove plaintext credential storage fallback

Credential writes now require Electron safeStorage encryption. Legacy plaintext values remain readable for migration and are encrypted during the next successful save. The UI override and status IPC are removed.

lib/secret-store.js

@@ -38,23 +38,17 @@ function isEncrypted(value) {
   return typeof value === 'string' && value.startsWith(SENTINEL);
 }
 
-function getAvailabilityStatus() {
-  return getSafeStorage() ? 'available' : 'unavailable';
-}
-
-function encryptField(value, options = {}) {
+function encryptField(value) {
   if (!value || typeof value !== 'string') return value;
   if (isEncrypted(value)) return value;
   const ss = getSafeStorage();
   if (!ss) {
-    if (options.allowPlaintext === true) return value;
     throw new SecretStoreError('SECRET_STORE_UNAVAILABLE', 'Sicherer Zugangsdaten-Speicher ist nicht verfügbar');
   }
   try {
     const buf = ss.encryptString(value);
     return SENTINEL + buf.toString('base64');
   } catch (cause) {
-    if (options.allowPlaintext === true) return value;
     throw new SecretStoreError('SECRET_STORE_ENCRYPT_FAILED', 'Zugangsdaten konnten nicht sicher verschlüsselt werden', cause);
   }
 }
@@ -88,14 +82,13 @@ function mapHosterAccounts(config, fn) {
   return config;
 }
 
-function encryptCredentials(config, options = {}) {
-  return mapHosterAccounts(config, value => encryptField(value, options));
+function encryptCredentials(config) {
+  return mapHosterAccounts(config, encryptField);
 }
 function decryptCredentials(config) { return mapHosterAccounts(config, decryptField); }
 
 module.exports = {
   SecretStoreError,
-  getAvailabilityStatus,
   encryptField,
   decryptField,
   encryptCredentials,