Embed the Composio key in the app bundle instead of shipping cred.txt

Root cause of the recurring 401: a revoked key was hardcoded in
startup-recovery.ts and onboarding-service.ts and reseeded into
composio_settings on every launch, and the interim fix shipped cred.txt
as a visible file under resources/.

- electron.vite.config.ts reads the gitignored cred.txt at build time
  and injects the key into the main-process bundle as
  __COMPOSIO_API_KEY__; no credential file is packaged and the key is
  not user-visible or configurable. The renderer bundle never sees it.
- Delete both hardcoded-key seeders; migration 046 purges stored
  api_key and never-read toolkits rows while keeping entity_id and
  auth_config state.
- Stop shipping composio_settings in the renderer snapshot.

src/main/database/migrations/046-composio-key-purge.ts

@@ -0,0 +1,10 @@
+/**
+ * The Composio API key used to be seeded into composio_settings per
+ * organization — including a revoked hardcoded key that kept resurfacing.
+ * The key now ships embedded in the main-process bundle and is never
+ * persisted, so stored copies (and the never-read toolkits rows) are purged.
+ * entity_id and auth_config:* rows stay: connections still use them.
+ */
+export const composioKeyPurgeSchema = `
+  delete from composio_settings where key in ('api_key', 'toolkits');
+`;