fix(privacy): store CarpUser/OAuth tokens in secure storage instead of SharedPreferences

## Problem
(verified in-repo / dependency-assisted) `LocalSettings` writes the whole `CarpUser` as JSON to SharedPreferences (`lib/data/local_settings.dart:36-50`, `jsonEncode(user.toJson())` at :48). `CarpUser` carries the `OAuthToken` (verified: carp_webservices-4.1.0 `carp_user.dart:30`; its generated serializer includes it — generated code in the dependency, not line-verified). So access + refresh tokens sit in plaintext prefs. `flutter_secure_storage` is already in the dependency graph (pubspec.lock) — adopting it adds no new dependency weight.

## Proposed fix
Store the token (or whole user) via `flutter_secure_storage` (Keychain/Keystore); one-time migration: read old key → write secure → delete old.

**Decision needed:** migrate silently vs. force re-login on next update (simpler, acceptable if release-noted).

## Acceptance criteria
- [ ] No token material in any SharedPreferences XML/plist after upgrade (manual inspection on both platforms)
- [ ] Existing sessions survive (or documented re-login)
- [ ] Lands with/after #595's AuthService to avoid double-moving code

**Effort:** M · **Priority:** P1 · **Change risk:** Medium (auth persistence; needs upgrade-path testing)