Import Gemini credentials into shared Keychain store

[cbusillo]

Summary

• Adds a shared Keychain-backed provider credential store for app/refresh-agent Gemini OAuth data
• Adds Keychain access-group entitlements to the app and refresh agent
• Lets Gemini refresh prefer imported credentials while retaining auth-file fallback
• Adds a Settings import action for Gemini credentials

Refs #64
Refs #68

Validation

• swift test --filter ProviderConnectorTests
• scripts/commit-gate.sh

Notes

• Unit tests prove imported credentials are preferred and file fallback still works.
• A standalone signed temp Keychain probe was killed by macOS before producing read/write output, so live signed app/login-item proof remains pending after install from this branch.