refactor(storage): inject KeychainHelper into storage classes via init

[datlechin]

Summary

Four storage classes that read the keychain (AIKeyStorage, SSHProfileStorage, ConnectionStorage, LicenseStorage) now hold a private let keychain: KeychainHelper and read through it instead of dialing KeychainHelper.shared 24 times.

• Each class's init now accepts keychain: KeychainHelper = .shared (matching the pattern already used for syncTracker and appSettings in ConnectionStorage).
• private init() is dropped on AIKeyStorage, SSHProfileStorage, and LicenseStorage so tests can inject a different keychain. The static let shared = X() line still calls the parameterless default.
• 24 raw KeychainHelper.shared.X calls converted to keychain.X.

Why this matters

This is the next slice of audit findings 3.1 + arch 5.1 ("complete the AppServices threading"). After PRs #1151 and #1152 widened AppServices and converted services-aware files, this PR addresses the storage layer's internal cross-references. KeychainHelper is now a dependency of each storage class, not a global it reaches for. Fits the audit's recommended "complete the migration" path.

Test plan

• Save / load / delete a database password.
• Save / load / delete an SSH password / key passphrase / TOTP secret on an SSH profile.
• Save / load / delete an AI provider API key.
• Save / delete the license key (Pro purchase / sign-out).
• swiftlint --strict clean on changed files.