refactor(kon): clean up storage and cloud-providers — remove unused deps, add safety docs

- Remove unused chrono and uuid dependencies from kon-storage
- Add schema versioning TODO to run_migrations() for pre-release safety
- Add doc comment and usage example to log_error() (uncalled public API)
- Add TODO to consolidate app_data_dir() with model_manager::dirs_path()
- Add safety comments and #[allow(deprecated)] to keystore set_var usage
- Add TODO for keyring crate migration in cloud-providers keystore
- Apply cargo fmt

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/cloud-providers/src/keystore.rs

@@ -1,14 +1,29 @@
 /// Store an API key in the OS keychain.
-/// Stub implementation using environment variables until keyring crate is added.
+///
+/// Stub implementation using environment variables until the `keyring` crate is
+/// added. Keys are only held in-process and lost on exit.
+///
+/// # Safety note
+/// `std::env::set_var` is deprecated in Rust 2024 edition and is **not**
+/// thread-safe — mutating the environment while other threads read it is
+/// undefined behaviour. This is acceptable during single-threaded app init
+/// but must not be called from async/multi-threaded contexts.
+///
+/// TODO: Replace with the `keyring` crate (or platform-native credential
+/// storage) so keys persist across sessions and are accessed safely.
+#[allow(deprecated)] // set_var deprecated in Rust 2024 edition
 pub fn store_api_key(provider: &str, key: &str) {
-    std::env::set_var(
-        format!("KON_API_KEY_{}", provider.to_uppercase()),
-        key,
-    );
+    // SAFETY: Only safe when called from a single-threaded context (e.g. app
+    // initialisation). See doc comment above.
+    std::env::set_var(format!("KON_API_KEY_{}", provider.to_uppercase()), key);
 }
 
 /// Retrieve an API key from the OS keychain.
-/// Stub implementation using environment variables until keyring crate is added.
+///
+/// Stub implementation using environment variables until the `keyring` crate is
+/// added. Returns `None` if no key has been stored this session.
+///
+/// TODO: Replace with the `keyring` crate alongside `store_api_key`.
 pub fn retrieve_api_key(provider: &str) -> Option<String> {
     std::env::var(format!("KON_API_KEY_{}", provider.to_uppercase())).ok()
 }