security(phase-9): complete security hardening

- Add safeJsonParse utility with schema validation
- Migrate tokens to OS keyring storage
- Add Ed25519 key encryption at rest
- Enable WSS configuration option
- Fix JSON.parse in HandParamsForm, WorkflowEditor, WorkflowList
- Update test mock data to match valid status values

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

desktop/src/store/teamStore.ts

@@ -23,6 +23,7 @@ import type {
   ReviewFeedback,
   TaskDeliverable,
 } from '../types/team';
+import { parseJsonOrDefault } from '../lib/json-utils';
 
 // === Store State ===
 
@@ -136,7 +137,7 @@ export const useTeamStore = create<TeamStoreState>((set, get) => ({
     try {
       // For now, load from localStorage until API is available
       const stored = localStorage.getItem('zclaw-teams');
-      const teams: Team[] = stored ? JSON.parse(stored) : [];
+      const teams: Team[] = stored ? parseJsonOrDefault<Team[]>(stored, []) : [];
       set({ teams, isLoading: false });
     } catch (error) {
       set({ error: (error as Error).message, isLoading: false });