refactor(qbz-credentials): extract credential store into a crate

Moves the credentials module (keyring + AES-256-GCM encrypted file
store for Qobuz credentials and the OAuth token) out of src-tauri into
a new qbz-credentials crate. src-tauri/credentials re-exports it, so the
Tauri app keeps identical behavior while the Slint shell can share the
exact same implementation, encrypted file, and keyring entries.

The module was already fully self-contained (no Tauri, no crate::
references); only the dependency declarations move with it.

cc

src-tauri/Cargo.lock

@@ -5126,6 +5126,23 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "qbz-credentials"
+version = "0.1.0"
+dependencies = [
+ "aes-gcm",
+ "ashpd",
+ "base64 0.22.1",
+ "dirs",
+ "keyring",
+ "log",
+ "rand 0.10.1",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "tokio",
+]
+
 [[package]]
 name = "qbz-integrations"
 version = "0.1.0"
@@ -5207,6 +5224,7 @@ dependencies = [
  "qbz-cast",
  "qbz-cmaf",
  "qbz-core",
+ "qbz-credentials",
  "qbz-integrations",
  "qbz-library",
  "qbz-models",