keystore migration: surface plaintext copies that could not be shredded

[Prekzursil]

Follow-up to #262. shredFile now correctly returns false for a locked/read-only/unwritable plaintext copy (no longer falsely reported as shredded), but migrateLegacyPlaintextKeys still proceeds silently -- a lingering plaintext key copy is not surfaced. Add an unshreddable list to the migration result and warn (main.ts log + optionally the UI) so the user can remove the copy manually. Security-aligned; small. Session: https://claude.ai/code/session_01CaUSwiidebWvpgMs2wQgqL