Move review-provider API keys from localStorage to OS credential storage

[sarthakagrawal927]

Why

CodeQL alert #5 (js/clear-text-storage-of-sensitive-data) confirms a known security debt: saveReviewConfig serializes gatewayApiKey into browser localStorage. The desktop-only threat model reduces remote exposure but does not protect the credential from webview compromise, localStorage export, or local inspection.

Requirement

Provider credentials must be stored through an OS-backed credential boundary and must never be serialized into localStorage, SQLite, logs, analytics, review receipts, or MCP output. Non-secret provider settings and standards packs may remain in localStorage.

Design constraints

• Preserve existing Anthropic, OpenAI, and OpenRouter behavior.
• Provide an explicit migration path that removes the legacy localStorage key after a successful credential-store write.
• Fail closed if secure storage is unavailable; do not silently fall back to plaintext persistence.
• Keep browser-mode behavior explicit and non-persistent.
• Any new production dependency requires owner review of maintenance, licensing, signing/notarization, and platform support before adoption.
• Add tests for migration, absence of serialized credentials, unavailable storage, update, and deletion.

Acceptance

• Approve the OS credential-store design and any production dependency.
• Implement typed Tauri IPC for credential read/write/delete.
• Migrate and erase the legacy localStorage credential safely.
• Keep non-secret review configuration backward compatible.
• Add Rust and TypeScript tests proving credentials are never persisted outside the secure store.
• Re-run CodeQL and close alert [ImgBot] Optimize images #5 with executable evidence.

Evidence

• CodeQL alert: https://github.com/Codevetter/codevetter/security/code-scanning/5
• Current source: apps/desktop/src/lib/review-service.ts (saveReviewConfig).
• Discovered while executing Adopt external quality tools without weakening verdict authority #193.

[sarthakagrawal927]

Design correction from current-source audit: the provider key/base URL/model are no longer consumed by any review execution path. They are referenced only by Settings, Rubrics fallback shape, review-service persistence, and tests; the browser AI gateway client and review execution path were removed in the earlier dead-code sweep. Therefore adding an OS credential dependency would preserve a misleading, non-functional model-picker surface. Revised recommendation: remove the dead AI Provider panel and provider fields, make review-service persist only rubric/standards data, and scrub any legacy gatewayApiKey/base/model fields from localStorage on read. This closes the actual CodeQL exposure with no production dependency while preserving the active rubric behavior. I am implementing this bounded security cleanup locally and will leave the issue open until source is pushed and CodeQL reruns.

[sarthakagrawal927]

Implementation receipt, 2026-08-31:

Source inspection showed the Settings provider panel and gateway fields were dead configuration: the review runtime no longer consumed them. The safer design is therefore removal, not adding an OS credential dependency to preserve unused behavior.

Local implementation now removes the provider UI and provider fields, allowlists only review-standard configuration, rewrites legacy localStorage records without credential, URL, or model fields, and deletes malformed records. Focused migration tests pass 11 of 11; the full desktop unit suite passes 676 with one skipped, and the 20-scenario live qualification passes. Runtime source has no gatewayApiKey, gatewayBaseUrl, gatewayModel, provider preset, or base-URL provider inference references.

The issue remains open until these local changes are pushed and CodeQL alert 5 reruns clean. No production dependency was added.