security: Encrypt API key storage

## What
Store API keys in macOS Keychain or encrypted storage instead of plain SQLite.

## Why
- API keys stored in SQLite without encryption (db/mod.rs settings table)
- Keys are stored locally but not protected
- App claims privacy-first approach but lacks key protection
- Risk: Unauthorized access to device could expose API keys

## How
- Use macOS Keychain for secure key storage
- Or encrypt sensitive settings with device-specific key
- Mark key field as sensitive in database schema
- Consider using keychain-rs crate for cross-platform support