security(phase-9): complete security hardening

- Add safeJsonParse utility with schema validation
- Migrate tokens to OS keyring storage
- Add Ed25519 key encryption at rest
- Enable WSS configuration option
- Fix JSON.parse in HandParamsForm, WorkflowEditor, WorkflowList
- Update test mock data to match valid status values

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/desktop/gatewayStore.test.ts

@@ -313,8 +313,8 @@ function resetClientMocks() {
   // OpenFang mock defaults
   mockClient.listHands.mockResolvedValue({
     hands: [
-      { name: 'echo', description: 'Echo handler', status: 'active' },
-      { name: 'notify', description: 'Notification handler', status: 'active' },
+      { name: 'echo', description: 'Echo handler', status: 'idle', requirements_met: true },
+      { name: 'notify', description: 'Notification handler', status: 'idle', requirements_met: true },
     ],
   });
   mockClient.triggerHand.mockImplementation(async (name: string) => ({
@@ -481,8 +481,8 @@ describe('OpenFang actions', () => {
         id: 'echo',
         name: 'echo',
         description: 'Echo handler',
-        status: 'active',
-        requirements_met: undefined,
+        status: 'idle',
+        requirements_met: true,
         category: undefined,
         icon: undefined,
         toolCount: undefined,
@@ -492,8 +492,8 @@ describe('OpenFang actions', () => {
         id: 'notify',
         name: 'notify',
         description: 'Notification handler',
-        status: 'active',
-        requirements_met: undefined,
+        status: 'idle',
+        requirements_met: true,
         category: undefined,
         icon: undefined,
         toolCount: undefined,