Consolidate importer credentials into a single keychain item

[Copilot]

Importers were persisting credentials as separate keychain items, which could trigger repeated password prompts. This change moves importer credential storage behind one shared keychain record while preserving the existing importer-facing API.

• Credential storage

  • Replace per-key keychain writes with a single serialized credential dictionary stored under one keychain item.
  • Keep saveCredential(_:for:) / readCredential(_:) unchanged for importers, so the change stays isolated to ImportManager.

• Legacy migration

  • When a credential is requested and only an older per-key entry exists, migrate it into the shared record on read.
  • Clean up the legacy item after the shared write succeeds.

• Concurrency and failure handling

  • Serialize credential access during reads/writes and migration.
  • Add targeted logging for shared-store reads, migration failures, and legacy cleanup paths without logging credential identifiers.

private enum CredentialStorage {
    static let keychainKey = "importer-credentials"
}

func saveCredential(_ value: String, for key: String) {
    if !saveCredentialLocked(value, for: key) {
        Logger.importer.error("Failed to save credential into shared storage")
    }
}