[wgqqqqq]

Problem

After the macOS credential backend moved from Keychain to the encrypted file vault, existing subscription metadata could remain visible while its Keychain token chunks were no longer readable. Those accounts were shown as requiring reauthentication even though the credentials were still present in the legacy store.

Change

• Read historical macOS Keychain service names during subscription-store loading.
• Migrate legacy v2 chunked OAuth/API credentials into the current file vault.
• Migrate the older combined JSON credential shape and upgrade its metadata.
• Keep migration serialized, retryable, idempotent, and non-destructive; legacy Keychain entries are preserved.
• Add isolated tests for v2 chunk migration, legacy metadata upgrade, and post-migration reads.

Validation

• cargo test --locked -p openbitfun-ai-adapters --features subscription-auth --lib subscription_auth
  • 139 passed, 5 existing live tests ignored.
• cargo check --locked -p openbitfun-ai-adapters --features subscription-auth --lib
• pnpm run fmt:rs
• git diff --check

pnpm run check:core-boundaries remains blocked by an existing missing generated file under src/apps/desktop/probes/remote-desktop/target/cxxbridge.

This PR was AI-assisted and fully tested with the focused subscription-auth suite.