feat(security): encrypt secrets and centralize app state

Store Twitch and Discord secrets as versioned safeStorage ciphertext behind explicit trusted IPC. Migrate legacy JSON transactionally into authoritative SQLite config and ordered queue repositories with rollback-safe markers and sanitized backups. Redact config exports and update renderer and release-harness contracts for secret-free config responses.

src/renderer-globals.d.ts

@@ -1,6 +1,5 @@
 interface AppConfig {
     client_id?: string;
-    client_secret?: string;
     download_path?: string;
     streamers?: string[];
     streamer_display_names?: Record<string, string>;
@@ -27,7 +26,6 @@ interface AppConfig {
     auto_record_poll_seconds?: number;
     download_chat_replay?: boolean;
     capture_live_chat?: boolean;
-    discord_webhook_url?: string;
     discord_notify_live_start?: boolean;
     discord_notify_live_end?: boolean;
     discord_notify_vod_complete?: boolean;
@@ -172,6 +170,12 @@ interface VideoInfo {
     variableFrameRate: boolean;
 }
 
+interface SecretStatus {
+    encryptionAvailable: boolean;
+    clientSecretConfigured: boolean;
+    discordWebhookConfigured: boolean;
+}
+
 interface VideoEditorMedia {
     sourceUrl: string;
     info: VideoInfo;
@@ -370,6 +374,11 @@ interface ArchiveStats {
 interface ApiBridge {
     getConfig(): Promise<AppConfig>;
     saveConfig(config: Partial<AppConfig>, fileCapability?: string): Promise<AppConfig>;
+    getSecretStatus(): Promise<SecretStatus>;
+    setClientSecret(value: string): Promise<SecretStatus>;
+    clearClientSecret(): Promise<SecretStatus>;
+    setDiscordWebhook(value: string): Promise<SecretStatus>;
+    clearDiscordWebhook(): Promise<SecretStatus>;
     login(): Promise<boolean>;
     getUserId(username: string): Promise<string | null>;
     getVODs(userId: string, forceRefresh?: boolean): Promise<VOD[]>;