AI service API keys are stored in plaintext in preference.json #2798

Summary

Each configured AI service (src/AI/Service.cs) holds an ApiKey, and the whole Preferences object is serialized to preference.json in cleartext (ViewModels/Preferences.cs, Save()). The API key is therefore written to disk unprotected:

• macOS/Linux: ~/.config/SourceGit/preference.json (or the platform config dir)
• Windows: %APPDATA%\SourceGit\preference.json

Anything able to read the user's config directory — other processes, backups, sync clients, log/crash collectors — can read the key. These keys are usually billable (OpenAI, Azure OpenAI), so disclosure has direct cost.

Current state

• Service.ApiKey is a plain serialized property.
• Service.ReadApiKeyFromEnv lets a user instead store the name of an environment variable and read the key from the environment, which avoids writing the secret — but it is opt-in and off by default, and the default path writes the key to disk.

Request

Store API keys in the OS secret store instead of preference.json:

• macOS: Keychain
• Windows: Credential Manager (or DPAPI)
• Linux: libsecret / Secret Service

Persist a non-secret reference in preference.json and resolve the secret at use time.

Notes

Secure storage is platform-specific, so this needs a small abstraction with per-OS backends, plus a decision on migrating existing plaintext keys. Happy to work on a PR; flagging the design points (backend choice, migration/removal of the existing plaintext value) for maintainer input first.