feat(macos): add macOS menu-bar app and harden cross-device iCloud sync

Introduce a standalone macOS menu-bar app (OSGKeyboardMac) that reuses the
platform-agnostic OSGKeyboardShared core: record -> cloud/local ASR -> polish
-> insert. Local mode uses Qwen3-ASR via mlx-swift-asr (macOS 15+, Apple
Silicon); iOS targets stay zero-SPM.

Harden iCloud sync for multi-device correctness:
- Per-field settings merge (appSettings.v2) so concurrent edits no longer
  clobber each other's unrelated fields.
- Per-device usage statistics (G-Counter) that sum instead of max().
- Tombstoned dictionary/history merge so deletes propagate and entries can't
  resurrect.
- API keys replicate via iCloud Keychain, never iCloud KVS JSON; pulling a
  legacy blob without key fields no longer wipes local Keychain entries.
- Add a low-risk "Sync Now" action in Settings.

Fix Flow keyboard mic state: stay orange until the host publishes a real ready
contract, share a single MicVoiceAvailability gate, and self-heal stale
cross-process heartbeat jitter instead of getting stuck.

Extract shared storage (SpeechHistoryStore/UsageStatisticsStore,
ConfigurationStore) into OSGKeyboardShared and add tests for the new
sync/merge logic.

OSGKeyboardShared/Services/CloudASR/CloudASRClients.swift

@@ -16,7 +16,7 @@ public protocol CloudASRTranscribing: Sendable {
 }
 
 public enum CloudASRClientFactory {
-    public static func make(store: AppGroupStore, session: URLSession = .shared) -> CloudASRTranscribing {
+    public static func make(store: any ConfigurationStore, session: URLSession = .shared) -> CloudASRTranscribing {
         let strategy = CloudASRModelCatalog.strategy(for: store.providerId)
         switch strategy {
         case .zhipuHotwords:
@@ -29,7 +29,7 @@ public enum CloudASRClientFactory {
             return AlibabaFunASRClient(
                 apiKey: store.apiKey,
                 model: CloudASRModelCatalog.defaultModel(for: store.providerId),
-                store: store,
+                persistence: store.cloudASRPersistence,
                 session: session
             )
         case .prompt:
@@ -149,12 +149,12 @@ struct ZhipuCloudASRClient: CloudASRTranscribing {
 
 // MARK: - Alibaba Fun-ASR Flash (vocabulary_id + context)
 
-struct AlibabaFunASRClient: CloudASRTranscribing {
+/// `UserDefaults` is not `Sendable`; we only touch `persistence` on the
+/// actor-isolated cloud ASR path, same as the previous `AppGroupStore` holder.
+struct AlibabaFunASRClient: CloudASRTranscribing, @unchecked Sendable {
     let apiKey: String
     let model: String
-    // Hold the (@unchecked Sendable) AppGroupStore rather than a raw
-    // UserDefaults so this struct stays Sendable under strict concurrency.
-    let store: AppGroupStore
+    let persistence: UserDefaults
     let session: URLSession
 
     func prepare(dictionary: PersonalDictionary) async throws {
@@ -162,7 +162,7 @@ struct AlibabaFunASRClient: CloudASRTranscribing {
             dictionary: dictionary,
             apiKey: apiKey,
             targetModel: CloudASRModelCatalog.alibabaVocabularyTargetModel,
-            defaults: store.defaults,
+            defaults: persistence,
             session: session
         )
     }
@@ -179,7 +179,7 @@ struct AlibabaFunASRClient: CloudASRTranscribing {
             dictionary: dictionary,
             apiKey: apiKey,
             targetModel: CloudASRModelCatalog.alibabaVocabularyTargetModel,
-            defaults: store.defaults,
+            defaults: persistence,
             session: session
         )
 

OSGKeyboardShared/Services/CloudASR/CloudASRService.swift

@@ -8,7 +8,7 @@ import Foundation
 import os
 
 public final class CloudASRService: ASRService, @unchecked Sendable {
-    private let store: AppGroupStore
+    private let store: any ConfigurationStore
     private let session: URLSession
     private let localFallback: ASRService
     private let lock = OSAllocatedUnfairLock()
@@ -18,7 +18,7 @@ public final class CloudASRService: ASRService, @unchecked Sendable {
     private var cancelled = false
 
     public init(
-        store: AppGroupStore = AppGroupStore(),
+        store: any ConfigurationStore = AppGroupStore(),
         session: URLSession = .shared,
         localFallback: ASRService? = nil
     ) {