One product per machine: the CLI and the desktop app share one version, the store accounts and the app folder list

- one version: package.json's version is the desktop app's too (desktopVersion removed); tools/desktop-version.ts
  keeps the plugin manifests and the app's copies equal, desktop-release publish refuses another version, release
  order app first then npm publish; the unpublished desktop 0.1.0 candidate is noted in the docs and CHANGELOG
- storebound desktop installs (per user, no admin: macOS DMG -> /Applications or ~/Applications, Windows NSIS /S,
  Linux AppImage + .desktop with the storebound:// handler), updates an older app, notes a newer one (downgrade only
  with --force), asks once ([Y/n], --yes, exit 3 without a terminal), opens on the folder; --dry / --json / --download;
  the install steps are pure plans (cli/lib/desktop-install.ts); the version's own manifest dl/<version>/latest.json
- credentials: one store, the CLI's credential profiles in ~/.storebound/credentials; the desktop writes and reads
  them (profiles.rs, files 0600), moves old keychain accounts into profiles on first start, shows profiles the CLI
  made; precedence env > named profile > project file > default profile; config `account`, "account" in the
  project's credentials.json; storebound accounts list | import (dedup by key id / service account e-mail, key files
  copied 0600, project file keeps keystore and review contact, backup, --dry, never prints values) | use
- app folders: one list ~/.storebound/projects.json shared by the desktop (registry.rs), storebound desktop,
  apps folders | add | remove, ws init and ws without a workspace file
- desktop: notice when a folder pins another storebound version; storebound-desktop --version
- tests: version drift, desktop decisions and per-OS plans, credential precedence and import, registry (TS + Rust),
  keychain migration and profile round trip (Rust), boot check with old keychain state and the new shared state

cli/lib/config.ts

@@ -3,6 +3,7 @@
 import { existsSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import * as rt from './rt';
+import { PROFILE_RE, setConfigAccount } from './credentials';
 import { validateCapture, validateRecord } from '../shots/devices';
 import { type AppleDataTypeId, type AppleTypeAnswer, validateAppPrivacyTypes } from './app-privacy';
 import { type AppEventDef, type CustomProductPageDef, validateCpp, validateEvents } from './cpp-events';
@@ -518,6 +519,10 @@ export interface ShipConfig {
     website: string;
     contactEmail: string;
   };
+  /** The credential profile (~/.storebound/credentials/<name>.json: the Apple team key and Play service account,
+   *  shared by every project and the desktop app) this app's store commands use. Default: the only profile on this
+   *  machine, or the one named "default". `--account <name>` overrides it for one run. A name, never a secret. */
+  account?: string;
   /** Accounts in the app: account deletion checks (Apple 5.1.1(v), Play Data safety delete-account URL). */
   accounts?: AccountsConfig;
   /** Sign-in for store reviewers (demo account; credentials live in .storebound/ only). */
@@ -998,6 +1003,7 @@ export function validateConfig(c: unknown): string[] {
   const e: string[] = [];
   const cfg = c as Partial<ShipConfig>;
   if (!cfg || typeof cfg !== 'object') return ['config must be an object'];
+  if (cfg.account !== undefined && (typeof cfg.account !== 'string' || !PROFILE_RE.test(cfg.account))) e.push('account: a credential profile name (letters, digits, . _ -), never a key');
   const app = cfg.app;
   if (!app) e.push('app: missing');
   else {
@@ -1187,6 +1193,7 @@ export async function loadConfig(explicit?: string, start = process.cwd()): Prom
   const errors = validateConfig(config);
   if (errors.length) throw new Error(`${path}:\n  ` + errors.join('\n  '));
   const root = dirname(path);
+  setConfigAccount(root, config.account);
   return { config, root, path, resolve: (p: string) => (isAbsolute(p) ? p : join(root, p)) };
 }