fix(storage): storage settings corrupt recovery

[chinawch007]

Summary

Fixes #4285

Completes the read-side follow-up to #4505. Previously, an empty or truncated settings.json failed settings loading with a bare SyntaxError; corrupt mcp.json likewise offered no actionable recovery guidance.

• Recover settings without discarding the damaged file. Only JSON parse failures trigger recovery. Save the original bytes to an exclusive 0600 backup on POSIX, synchronize it, then restore defaults through the existing atomic writer. Read/normalization/migration errors still propagate. A failure after default publication remains commit-unknown and never automatically replays the caller's mutation.
• Report and apply the recovery in Desktop. Localized notifications distinguish recovery from unconfirmed durability and name the backup. Reuse the settings effects queue to refresh running consumers; track renderer notification separately so a silent theme refresh cannot swallow the reset event.
• Keep corrupt MCP configuration intact and explain the next step. Typed errors name the file without quoting potentially secret JSON. Desktop and TUI show repair guidance, including TUI mutations after successful startup. Error details scroll in small terminals; returning to the server list preserves live MCP state.

Recovery resets application preferences, bot configuration and onboarding state. It does not rewrite Runtime Policy or credential stores.

Verification

• Passed lint, format:check, full build, typecheck, and knip for Desktop and packages/ui.
• Affected compiled suites, with test concurrency limited to 4: storage 1,274 passed / 8 skipped, Desktop 2,594 passed, CLI 1,057 passed / 3 skipped. Backup/reset fault injection, callback isolation, mutation refusal and replay prevention are covered.
• The settings commit independently passed a full build and 65 targeted tests. Windows inventory and ASF headers passed in an isolated committed checkout.
• macOS Electron smoke passed startup recovery and nativeTheme.updated recovery with exactly one renderer event. Native notification delivery returned failed; failure isolation was verified. Windows/Linux application runs were not performed.

Reproducing a truncated settings file against the base and this change gave:

Before: SyntaxError; no backup.
After:  default settings loaded; one byte-for-byte backup.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex authored the implementation, regression tests, review fixes and this PR draft. Both commits include Generated-by: OpenAI Codex; retain the trailer in the final squash commit.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No