One-time re-auth: pre-separation keychain tokens unreadable by the server

GitHub/ChatGPT tokens stored by the pre-flip app are safeStorage(keychain)-encrypted; the server process can't decrypt them, so affected users sign in once more after updating (tokens then re-save under the server's file cipher). Decide whether to ship a one-time migration (main decrypts via keychain and hands tokens to the child) or accept the re-auth.

Follow-up from the client–server separation (#929).