feat(security): migrate API keys to IndexedDB, fix silent catches, add snapshot validation

[d-oit]

Summary

• Migrate API key storage from localStorage to encrypted IndexedDB (AES-GCM)
• Fix 11 silent catch blocks with proper logging across 7 files
• Add Zod validation for graph snapshot data
• Add ftp: to blocked URL schemes for SSRF prevention
• Add 34 new tests (graph-schemas, editor extensions, keyboard nav)

Changes

• New file: src/lib/key-store.ts — IndexedDB-backed encrypted key store with localStorage migration
• Updated: src/lib/llm/config.ts — Uses keyStore instead of localStorage, auto-migrates existing keys
• Updated: src/lib/llm/encryption.ts — Added logger for corrupted key recovery
• Updated: src/lib/resolver.ts — Added ftp: to blocked URL schemes
• Updated: src/features/graph/graph-schemas.ts — Added GraphSnapshotDataSchema and validateSnapshotData()
• Updated: src/features/graph/GraphSnapshotManager.ts — Validates snapshot data before loading
• Updated: 7 files with silent catch blocks — Added proper logging (logger.warn/debug)
• New tests: graph-schemas.test.ts (15), extensions.test.ts (12), GraphKeyboardNav.test.ts (7)
• Updated test: config.test.ts — Mocks IndexedDB key store instead of localStorage

Verification

• ✅ pnpm run lint — 0 errors
• ✅ pnpm run typecheck — clean
• ✅ pnpm run test — 445/445 passing
• ✅ pnpm run build — builds successfully

[codacy-production]

Not up to standards ⛔

🔴 Issues 13 high

Alerts:
⚠ 13 issues (≤ 0 issues of at least minor severity)

Results:
13 new issues

Category	Results
Security	13 high

View in Codacy

🟢 Metrics 82 complexity · 22 duplication

Metric	Results
Complexity	82
Duplication	22

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}