One product per machine: the CLI and the desktop app share one version, the store accounts and the app folder list

- one version: package.json's version is the desktop app's too (desktopVersion removed); tools/desktop-version.ts
  keeps the plugin manifests and the app's copies equal, desktop-release publish refuses another version, release
  order app first then npm publish; the unpublished desktop 0.1.0 candidate is noted in the docs and CHANGELOG
- storebound desktop installs (per user, no admin: macOS DMG -> /Applications or ~/Applications, Windows NSIS /S,
  Linux AppImage + .desktop with the storebound:// handler), updates an older app, notes a newer one (downgrade only
  with --force), asks once ([Y/n], --yes, exit 3 without a terminal), opens on the folder; --dry / --json / --download;
  the install steps are pure plans (cli/lib/desktop-install.ts); the version's own manifest dl/<version>/latest.json
- credentials: one store, the CLI's credential profiles in ~/.storebound/credentials; the desktop writes and reads
  them (profiles.rs, files 0600), moves old keychain accounts into profiles on first start, shows profiles the CLI
  made; precedence env > named profile > project file > default profile; config `account`, "account" in the
  project's credentials.json; storebound accounts list | import (dedup by key id / service account e-mail, key files
  copied 0600, project file keeps keystore and review contact, backup, --dry, never prints values) | use
- app folders: one list ~/.storebound/projects.json shared by the desktop (registry.rs), storebound desktop,
  apps folders | add | remove, ws init and ws without a workspace file
- desktop: notice when a folder pins another storebound version; storebound-desktop --version
- tests: version drift, desktop decisions and per-OS plans, credential precedence and import, registry (TS + Rust),
  keychain migration and profile round trip (Rust), boot check with old keychain state and the new shared state

apps/desktop/src/screens/Accounts.tsx

@@ -1,6 +1,7 @@
 // Studios & accounts: studios (name, colour, logo) group store accounts; each account is a Google Play service account
 // (one JSON key; it can be invited to several Play developer accounts) or an App Store Connect team key (key id,
-// issuer id, .p8). Keys live in the system keychain; the app keeps a label and the studio only. Per account: a health
+// issuer id, .p8). Keys live in the machine's credential profiles (~/.storebound, shared with the CLI);
+// the app keeps a label, the studio and the profile name only. Per account: a health
 // check (key works / permission missing / revoked, with the fix) and "Import apps" (every app the key can see).
 import { type FormEvent, useEffect, useState } from 'react';
 import { type Account, type AccountCheck, api, errorText, STUDIO_COLORS, type Studio, type StudioColor } from '../api';
@@ -59,6 +60,7 @@ function AccountRow({ a, busy, setBusy, onError }: { a: Account; busy: string |
           <div className="row" style={{ gap: 8 }}><span className="strong">{a.label}</span><HealthChip h={h} />{ignored && <Chip tone="neutral" icon="eyeOff">{t('acct.ignored')}</Chip>}</div>
           <div className="small muted">
             {a.kind === 'play' ? t('acct.kindPlay') : t('acct.kindApple')}
+            {' · '}{a.profile ? <span className="mono-id selectable" title="~/.storebound">{t('acct.profile', { name: a.profile })}</span> : t('acct.noProfile')}
             {' · '}{list ? t('acct.appsRead', { count: list.value.apps.length, when: ago(list.at) }) : t('acct.notImported')}
             {used ? ` · ${t('acct.folders', { count: used })}` : ''}
             {check?.principal ? <> · <span className="mono-id selectable">{check.principal}</span></> : null}

apps/desktop/src/screens/AppView.tsx

@@ -140,6 +140,7 @@ export function AppView({ app, tab }: { app: UnifiedApp; tab: AppTab }) {
       </div>
       <AppControls app={app} />
       {!app.project && <StoreOnlyBanner app={app} />}
+      {app.project?.storeboundPin && <Notice tone="info" icon="info">{t('app.pinNotice', { pin: app.project.storeboundPin, app: d.info?.version ?? '' })}</Notice>}
       {app.project?.missing ? <FolderMissing project={app.project} /> : <>
       <div className="tabs" role="tablist" aria-label={t('app.sections', { name })} onKeyDown={onKey}>
         {tabs.map((x, i) => (