One product per machine: the CLI and the desktop app share one version, the store accounts and the app folder list

- one version: package.json's version is the desktop app's too (desktopVersion removed); tools/desktop-version.ts
  keeps the plugin manifests and the app's copies equal, desktop-release publish refuses another version, release
  order app first then npm publish; the unpublished desktop 0.1.0 candidate is noted in the docs and CHANGELOG
- storebound desktop installs (per user, no admin: macOS DMG -> /Applications or ~/Applications, Windows NSIS /S,
  Linux AppImage + .desktop with the storebound:// handler), updates an older app, notes a newer one (downgrade only
  with --force), asks once ([Y/n], --yes, exit 3 without a terminal), opens on the folder; --dry / --json / --download;
  the install steps are pure plans (cli/lib/desktop-install.ts); the version's own manifest dl/<version>/latest.json
- credentials: one store, the CLI's credential profiles in ~/.storebound/credentials; the desktop writes and reads
  them (profiles.rs, files 0600), moves old keychain accounts into profiles on first start, shows profiles the CLI
  made; precedence env > named profile > project file > default profile; config `account`, "account" in the
  project's credentials.json; storebound accounts list | import (dedup by key id / service account e-mail, key files
  copied 0600, project file keeps keystore and review contact, backup, --dry, never prints values) | use
- app folders: one list ~/.storebound/projects.json shared by the desktop (registry.rs), storebound desktop,
  apps folders | add | remove, ws init and ws without a workspace file
- desktop: notice when a folder pins another storebound version; storebound-desktop --version
- tests: version drift, desktop decisions and per-OS plans, credential precedence and import, registry (TS + Rust),
  keychain migration and profile round trip (Rust), boot check with old keychain state and the new shared state

docs/getting-started.md

@@ -1,5 +1,11 @@
 # Getting started
 
+**The model.** storebound is installed once per machine (`npx storebound` / the desktop app, one version number).
+Each project has its `storebound.config.ts` and a gitignored `.storebound/` folder (upload keystore, review contact
+and demo account). Store accounts live once per machine in `~/.storebound/credentials` (shared by CLI and app:
+`storebound accounts`), and so does the list of app folders (`~/.storebound/projects.json`: `storebound apps folders`,
+the desktop's App folders). `npx storebound desktop` installs the app (asks once) and opens it on the current folder.
+
 ## 5-minute quick start
 
 You need [Node](https://nodejs.org) 20+ or [Bun](https://bun.sh) 1.1+ (and `ffmpeg` for icons, screenshots and video).
@@ -75,7 +81,22 @@ the age rating config, lanes and signing (`match`) are listed with their storebo
 
 ## Credentials (never in the repo)
 
-Read from environment variables, or from `.storebound/credentials.json` in your project (gitignored by `init`):
+Store accounts belong to the machine, everything else to the project:
+
+- **Store accounts** (App Store Connect team key, Play service account, vendor number): a credential profile in
+  `~/.storebound/credentials/<name>.json`, its key files next to it in `<name>/` (mode 0600). The desktop app adds and
+  reads the same profiles. Already have the keys in a project's `.storebound/credentials.json`? Move them once:
+  `npx storebound accounts import --dry`, then `npx storebound accounts import --yes` in every project: the same key
+  id or service account is one profile (`default` for the first one), and the project file keeps the rest and gets
+  `"account": "<name>"`. `npx storebound accounts` lists the profiles and which one this folder uses.
+- **Which profile:** `--account <name>` for one run, `account: '<name>'` in the config, `"account"` in the project's
+  `.storebound/credentials.json`, else the only profile on the machine (or the one named `default`).
+- **Per project:** the Android upload keystore, the App Review contact and demo account stay in the project's
+  `.storebound/credentials.json`.
+- **Order:** environment variables win over everything, then a profile the project names, then the project file,
+  then the default profile.
+
+The names (env, profile and project file alike; the project file is gitignored by `init`):
 
 | name | what |
 |---|---|
@@ -87,9 +108,8 @@ Read from environment variables, or from `.storebound/credentials.json` in your
 | `reviewContact` | (file only) App Review contact name / phone / email |
 | `reviewDemoAccount` / `REVIEW_DEMO_USER`, `REVIEW_DEMO_PASSWORD` | demo account for App Review (`reviewAccess.signInRequired`); never in the config or the repo, masked in logs |
 
-Several store accounts on one machine: credential profiles (`~/.storebound/credentials/<profile>.json`, the same names
-except the per-app upload keystore)
-picked with `--account <profile>` or by a workspace ([Many apps and studios](studios.md#many-apps-and-studios)).
+Several store accounts on one machine: one profile each, picked as above or by a workspace
+([Many apps and studios](studios.md#many-apps-and-studios)).
 
 
 ## Install for your AI tool