One product per machine: the CLI and the desktop app share one version, the store accounts and the app folder list

- one version: package.json's version is the desktop app's too (desktopVersion removed); tools/desktop-version.ts
  keeps the plugin manifests and the app's copies equal, desktop-release publish refuses another version, release
  order app first then npm publish; the unpublished desktop 0.1.0 candidate is noted in the docs and CHANGELOG
- storebound desktop installs (per user, no admin: macOS DMG -> /Applications or ~/Applications, Windows NSIS /S,
  Linux AppImage + .desktop with the storebound:// handler), updates an older app, notes a newer one (downgrade only
  with --force), asks once ([Y/n], --yes, exit 3 without a terminal), opens on the folder; --dry / --json / --download;
  the install steps are pure plans (cli/lib/desktop-install.ts); the version's own manifest dl/<version>/latest.json
- credentials: one store, the CLI's credential profiles in ~/.storebound/credentials; the desktop writes and reads
  them (profiles.rs, files 0600), moves old keychain accounts into profiles on first start, shows profiles the CLI
  made; precedence env > named profile > project file > default profile; config `account`, "account" in the
  project's credentials.json; storebound accounts list | import (dedup by key id / service account e-mail, key files
  copied 0600, project file keeps keystore and review contact, backup, --dry, never prints values) | use
- app folders: one list ~/.storebound/projects.json shared by the desktop (registry.rs), storebound desktop,
  apps folders | add | remove, ws init and ws without a workspace file
- desktop: notice when a folder pins another storebound version; storebound-desktop --version
- tests: version drift, desktop decisions and per-OS plans, credential precedence and import, registry (TS + Rust),
  keychain migration and profile round trip (Rust), boot check with old keychain state and the new shared state

apps/desktop/src-tauri/src/accounts.rs

@@ -1,8 +1,10 @@
 //! Store accounts. The secret part (Play service account JSON, App Store Connect .p8 key with its key id and issuer)
-//! goes into the OS credential store under the service `dev.storebound.desktop`; only a label, the kind and the
-//! creation time are kept in the app data folder. Secrets are never sent to the webview: they are read from the
-//! keychain right before a sidecar call and handed to it in that call's params (memory only), which passes them to
-//! the storebound command as environment variables.
+//! lives in the machine's credential profiles, shared with the CLI (profiles.rs: ~/.storebound/credentials, files
+//! 0600); the app data folder keeps the label, the kind, the studio and the profile name. Versions before 0.8 kept
+//! the secret in the OS keychain (service `dev.storebound.desktop`): `Keychain` is still here to move those entries
+//! into profiles once (profiles::sync). Secrets are never sent to the webview: they are read right before a sidecar
+//! call and handed to it in that call's params (memory only), which passes them to the command as environment
+//! variables.
 use serde::{Deserialize, Serialize};
 use serde_json::{Map, Value};
 
@@ -25,6 +27,10 @@ pub struct Account {
     /// The studio this account belongs to (workspace::Studio id), if any.
     #[serde(default)]
     pub studio: Option<String>,
+    /// The credential profile that holds the key (~/.storebound/credentials/<profile>.json, shared with the CLI).
+    /// None only for an account of an earlier version whose keychain entry has not moved yet.
+    #[serde(default)]
+    pub profile: Option<String>,
 }
 
 /// The keychain entry of one account (JSON).
@@ -52,7 +58,10 @@ impl Secret {
             Secret::Apple { key_id, issuer_id, p8 } => {
                 into.insert("ASC_KEY_ID".into(), Value::String(key_id.clone()));
                 into.insert("ASC_ISSUER_ID".into(), Value::String(issuer_id.clone()));
-                into.insert("ASC_P8".into(), Value::String(p8.clone()));
+                // a profile without ASC_P8: the CLI finds ~/.appstoreconnect/private_keys/AuthKey_<id>.p8 itself
+                if !p8.is_empty() {
+                    into.insert("ASC_P8".into(), Value::String(p8.clone()));
+                }
             }
         }
     }
@@ -110,7 +119,7 @@ pub fn check_label(s: &str) -> Result<String, String> {
     Ok(s.to_string())
 }
 
-/// Where secrets live. The OS keychain in the app; a map in tests.
+/// The OS keychain entries of earlier versions (read once to move them into profiles, then deleted); a map in tests.
 pub trait SecretStore: Send + Sync {
     fn set(&self, id: &str, secret: &Secret) -> Result<(), String>;
     fn get(&self, id: &str) -> Result<Secret, String>;