feat(security): encrypt secrets and centralize app state

Store Twitch and Discord secrets as versioned safeStorage ciphertext behind explicit trusted IPC. Migrate legacy JSON transactionally into authoritative SQLite config and ordered queue repositories with rollback-safe markers and sanitized backups. Redact config exports and update renderer and release-harness contracts for secret-free config responses.

src/main/infra/db.ts

@@ -34,6 +34,10 @@ export function openDatabase(filePath: string): DbHandle {
     db.pragma('foreign_keys = ON');
 
     runMultiStatement(db, SCHEMA_V5_SQL);
+    const queueColumns = db.prepare('PRAGMA table_info(queue_items)').all() as Array<{ name: string }>;
+    if (!queueColumns.some((column) => column.name === 'queue_position')) {
+        db.prepare('ALTER TABLE queue_items ADD COLUMN queue_position INTEGER NOT NULL DEFAULT 0').run();
+    }
 
     const handle: DbHandle = {
         run(sql, params) {

src/main/infra/schema-v5.ts

@@ -20,6 +20,7 @@ CREATE TABLE IF NOT EXISTS config_kv (
 
 CREATE TABLE IF NOT EXISTS queue_items (
     id TEXT PRIMARY KEY,
+    queue_position INTEGER NOT NULL DEFAULT 0,
     streamer_login TEXT,
     vod_id TEXT,
     clip_id TEXT,
@@ -38,6 +39,13 @@ CREATE INDEX IF NOT EXISTS idx_queue_status ON queue_items(status);
 CREATE INDEX IF NOT EXISTS idx_queue_streamer ON queue_items(streamer_login);
 CREATE INDEX IF NOT EXISTS idx_queue_created ON queue_items(created_at);
 
+CREATE TABLE IF NOT EXISTS app_secrets (
+    key TEXT PRIMARY KEY,
+    version INTEGER NOT NULL,
+    encrypted_value TEXT NOT NULL,
+    updated_at INTEGER NOT NULL DEFAULT (strftime('%s','now'))
+);
+
 CREATE TABLE IF NOT EXISTS downloaded_vods (
     vod_id TEXT PRIMARY KEY,
     downloaded_at INTEGER NOT NULL DEFAULT (strftime('%s','now'))