fix(web): surface unavailable BYOK credential storage in settings

[anujbolewar]

Fixes #6330

Why

On Windows the daemon's secure credential store is fail-closed (unavailable-win32 backend after the DPAPI backend was withdrawn in #6308). Saving a BYOK key always fails there, but the web app gave no persistent explanation — a configured BYOK profile was silently cleared at boot and runs fell back to Open Design Cloud billing with no signal to the user.

What users will see

On a system where the daemon reports its secure credential store unavailable (Windows), Settings → Execution mode → BYOK now shows a persistent notice: secure BYOK credential storage is unavailable here, so BYOK API keys can't be saved and runs fall back to Open Design Cloud billing. Previously there was no indication why the key couldn't be saved.

Surface area

• UI — new persistent notice in the BYOK panel of apps/web Settings
• Keyboard shortcut — new or changed
• CLI / env var — new od subcommand or flag, new tools-dev / tools-pack flag, or new OD_* env var
• API / contract — new /api/* endpoint, new SSE event, or changed shape in packages/contracts
• Extension point — new entry under skills/, design-systems/, design-templates/, or craft/, or change to the skills protocol
• i18n keys — added settings.byokStorageUnavailableNotice to all 19 locales
• New top-level dependency — adding any new entry to the root package.json (dependencies or devDependencies); workspace-package package.json files are out of scope. Include a paragraph on what we get vs. what bytes we ship (see CONTRIBUTING.md → Code style)
• Default behavior change — changes what existing users experience without opting in (default model, default setting, file/SQLite schema, auto-network on startup, auto-install)
• None — internal refactor, docs, tests, or translation update only

Screenshots

UI change in apps/web; screenshots unavailable from this environment. The notice reuses the existing settings-test-status error notice styling already used by the BYOK precondition/draft notices, so no new visual surface is introduced.

Bug fix verification

• Test path that reproduces the bug: apps/web/tests/components/SettingsDialog.execution.test.tsx → "surfaces a persistent notice when the daemon reports BYOK credential storage unavailable (issue BYOK API key cannot be saved on Windows (v0.16.1) — runs fall back to Open Design Cloud billing #6330)"
• Did the test go red on main and green on this branch? yes — the spec asserted a notice that did not exist on main (failed on getByTestId('settings-byok-storage-unavailable-notice')) and passed after the source change.

Validation

• pnpm --filter @open-design/web test — focused: SettingsDialog.execution.test.tsx (151/151), SettingsDialog.test.ts + tests/state/config.test.ts (143/143)
• pnpm --filter @open-design/web typecheck — clean
• pnpm guard — exit 0
• git diff --check — clean

[lefarcen]

Thanks @anujbolewar — surfacing the fail-closed BYOK storage state directly in Settings is the right direction here. I’ll get this routed through the usual review gates now.

[lefarcen]

🧪 This PR has changes that need a manual QA pass before merge — please hold off self-merging for now; we’ll loop QA in once it’s merge-ready (and design/product have signed off, where applicable).