* fix: preserve auth across macOS keychain modes * docs(auth): clarify per-profile recovery * fix(auth): add safe macOS keychain migration * ci: add native Windows auth coverage * ci: scope Windows checks to auth paths * fix(auth): address keychain review boundaries