fix: harden managed online backup key handling

Require canonical encrypted envelopes and surface typed sanitized keyring corruption states.

Persist crash-durable primary and recovery files, prevalidate removal plans, isolate renderer refresh authority, and cover the real hidden Windows DPAPI and IPC composition.

lib/secret-store.js

@@ -35,7 +35,11 @@ function getSafeStorage() {
 }
 
 function isEncrypted(value) {
-  return typeof value === 'string' && value.startsWith(SENTINEL);
+  if (typeof value !== 'string' || !value.startsWith(SENTINEL)) return false;
+  const encoded = value.slice(SENTINEL.length);
+  if (!encoded || encoded.length % 4 !== 0) return false;
+  const decoded = Buffer.from(encoded, 'base64');
+  return decoded.length > 0 && decoded.toString('base64') === encoded;
 }
 
 function encryptField(value) {
@@ -55,7 +59,12 @@ function encryptField(value) {
 
 function decryptField(value) {
   if (!value || typeof value !== 'string') return value;
-  if (!isEncrypted(value)) return value;
+  if (!isEncrypted(value)) {
+    if (value.startsWith(SENTINEL)) {
+      throw new SecretStoreError('SECRET_STORE_DECRYPT_FAILED', 'Gespeicherte Zugangsdaten konnten nicht entschlüsselt werden');
+    }
+    return value;
+  }
   const ss = getSafeStorage();
   if (!ss) {
     throw new SecretStoreError('SECRET_STORE_UNAVAILABLE', 'Sicherer Zugangsdaten-Speicher ist nicht verfügbar');