feat(macos): add macOS menu-bar app and harden cross-device iCloud sync

Introduce a standalone macOS menu-bar app (OSGKeyboardMac) that reuses the
platform-agnostic OSGKeyboardShared core: record -> cloud/local ASR -> polish
-> insert. Local mode uses Qwen3-ASR via mlx-swift-asr (macOS 15+, Apple
Silicon); iOS targets stay zero-SPM.

Harden iCloud sync for multi-device correctness:
- Per-field settings merge (appSettings.v2) so concurrent edits no longer
  clobber each other's unrelated fields.
- Per-device usage statistics (G-Counter) that sum instead of max().
- Tombstoned dictionary/history merge so deletes propagate and entries can't
  resurrect.
- API keys replicate via iCloud Keychain, never iCloud KVS JSON; pulling a
  legacy blob without key fields no longer wipes local Keychain entries.
- Add a low-risk "Sync Now" action in Settings.

Fix Flow keyboard mic state: stay orange until the host publishes a real ready
contract, share a single MicVoiceAvailability gate, and self-heal stale
cross-process heartbeat jitter instead of getting stuck.

Extract shared storage (SpeechHistoryStore/UsageStatisticsStore,
ConfigurationStore) into OSGKeyboardShared and add tests for the new
sync/merge logic.

OSGKeyboardShared/Models/MicVoiceAvailability+Keyboard.swift

@@ -0,0 +1,45 @@
+// MicVoiceAvailability+Keyboard.swift
+// OSGKeyboard · Shared
+//
+// Derives keyboard mic availability from pipeline phase and host readiness.
+
+import Foundation
+
+public enum MicVoiceAvailabilityResolver {
+    public static func resolve(
+        phase: KeyboardState.Phase,
+        micDisabled: Bool,
+        hasFullAccess: Bool,
+        appGroupAvailable: Bool,
+        hostReady: Bool,
+        isPreparingSession: Bool
+    ) -> MicVoiceAvailability {
+        switch phase {
+        case .recording:
+            return .recording
+        case .processing, .requestingPermissions:
+            return .processing
+        case .error, .denied:
+            return .unavailable(.hostNotReady)
+        case .idle:
+            break
+        }
+
+        if !appGroupAvailable {
+            return .unavailable(.appGroupUnavailable)
+        }
+        if !hasFullAccess {
+            return .unavailable(.noFullAccess)
+        }
+        if micDisabled {
+            return .unavailable(.missingAPIKey)
+        }
+        if isPreparingSession {
+            return .unavailable(.preparingSession)
+        }
+        if hostReady {
+            return .ready
+        }
+        return .unavailable(.hostNotReady)
+    }
+}