feat: credentials page, master password change and a Diagnostics tab

- Settings → Security lists every profile's stored credentials (kind and
  whether it's in the keychain or the vault; the keychain is probed per
  kind on a background thread since it can't be listed) with Forget.
- Change Master Password re-encrypts every vault entry under a fresh
  salt and key with a new verifier, after checking the current password,
  in one atomic write (Vault::change_password; tested that the old
  password stops working and every value survives).
- Settings → Diagnostics shows version, platform, data/database/log
  paths and sizes, keychain and vault state, counts, sync and launch
  settings, with Copy Diagnostics; it never includes credentials.
  Openable with --open settings:diagnostics.

rust/app/src/app.rs

@@ -252,6 +252,7 @@ impl App {
                 "terminal" => SettingsTab::Terminal,
                 "security" => SettingsTab::Security,
                 "knownhosts" => SettingsTab::KnownHosts,
+                "diagnostics" => SettingsTab::Diagnostics,
                 "help" => SettingsTab::Help,
                 "about" => SettingsTab::About,
                 _ => SettingsTab::General,