feat(account): add managed credits and cloud gateway

Introduce optional Apple account-backed credits with scoped gateway access while preserving local and BYOK paths. Refresh assistant behavior, tests, privacy disclosures, docs, and the website for the 2.0 experience.

OSGKeyboardShared/Services/AppGroupStore.swift

@@ -56,9 +56,10 @@ public struct AppGroupStore: @unchecked Sendable {
     }
 
     private func mutateConfiguration(_ transform: (inout AppGroupConfiguration) -> Void) {
-        var config = AppGroupConfiguration.load(fromAvailable: defaults)
+        let baseline = AppGroupConfiguration.load(fromAvailable: defaults)
+        var config = baseline
         transform(&config)
-        config.save(to: defaults)
+        config.saveChanges(since: baseline, to: defaults)
     }
 
     // MARK: - Reads
@@ -74,6 +75,7 @@ public struct AppGroupStore: @unchecked Sendable {
     public var modeId: String { configuration.modeId }
     public var localeId: String { configuration.localeId }
     public var engineMode: String { configuration.engineMode }
+    public var credentialSource: CredentialSource { configuration.credentialSource }
     public var uiLanguage: AppUILanguage { configuration.uiLanguage }
     public var translationEnabled: Bool { configuration.translationEnabled }
     public var translationTargetLocaleId: String { configuration.translationTargetLocaleId }
@@ -121,6 +123,11 @@ public struct AppGroupStore: @unchecked Sendable {
         AppGroupConfigDarwin.postConfigChanged()
     }
 
+    public func setCredentialSource(_ source: CredentialSource) {
+        mutateConfiguration { $0.credentialSource = source }
+        AppGroupConfigDarwin.postConfigChanged()
+    }
+
     public func setUILanguage(_ language: AppUILanguage) {
         mutateConfiguration { $0.uiLanguage = language }
     }
@@ -387,7 +394,7 @@ public struct AppGroupStore: @unchecked Sendable {
 
     // MARK: - Client
 
-    public func makeClient() -> LLMClient {
-        configuration.makeClient()
+    public func makeClient(taskKind: ManagedGatewayTaskKind?) -> LLMClient {
+        configuration.makeClient(taskKind: taskKind)
     }
 }