feat(desktop): diagnostic + manual retry for legacy key migration

The 0.18.1 fix relied on an existing-device + present-stronghold-key match.
That fails for users who:
  - had multiple device registrations and only retain the latest device's
    private key in the local vault
  - had a vault wipe / fresh OS install at some point
  - have device rows that vanished server-side but keys still locally

Migration now scans conversation_keys for distinct un-migrated
recipient_device_ids visible to the user (RLS-filtered) and probes the
stronghold for each, regardless of whether the server still lists that
device. Result struct surfaces attempted/migrated/noKey/decryptFail/rpcFail
counters; SecurityCenter shows them via a new "Migration erneut ausführen"
button so users can self-diagnose without DevTools.

Also adds [crypto-migration] console.info breadcrumbs at every decision
point so a single F12 shows what happened.

packages/shared/src/chat/userKeyMigration.test.ts

@@ -23,10 +23,11 @@ describe('migrateOwnLegacyBundles', () => {
     const stubClient = {
       from: (table: string) => {
         if (table === 'conversation_keys') {
+          // Mirrors the new chain: .select(...).is('recipient_user_id', null).not('recipient_device_id', 'is', null)
           return {
             select: () => ({
-              in: () => ({
-                is: () => Promise.resolve({
+              is: () => ({
+                not: () => Promise.resolve({
                   data: [
                     {
                       conversation_id: 'conv-1',