fix(keychain): configure macOS credential access

[majd]

Summary

• pass the existing ipatool-auth.service name into the keychain wrapper
• apply that value to keyring.Item.Label so macOS authorization prompts identify the credential
• trust the executable that creates a new macOS Keychain item, avoiding repeated prompts for that same application identity
• retain coverage for legacy unlabeled credentials without rewriting or recreating them

Compatibility

The Keychain service, account key, serialized credential payload, and backend order are unchanged. Existing authenticated users continue reading the same item, and existing ACLs are preserved because duplicate-item updates do not replace access control.

The trust setting applies only when creating a new macOS item. It trusts only the creating executable, not all applications. A different bundled path or signing identity may still prompt once and require Always Allow.

Validation

• go generate ./...
• go test ./pkg/keychain
• go test ./...
• go build ./...
• git diff --check

Closes #517