Patch macOS keychain handling for CEF builds

Adds a macOS post-build step to patch CEF’s keychain service string to a Nebula-specific name, then re-sign the modified framework (with configurable signing identity or ad-hoc). Also enables Chromium’s `use-mock-keychain` switch on Apple builds to prevent repeated local keychain prompts, fixes titlebar traffic-light hit testing in the mac window view, scopes a WM_CLOSE guard to Windows only, and updates `.clangd` to ignore non-mac platform sources during macOS development.

.clangd

@@ -15,3 +15,22 @@ CompileFlags:
     - -Ithirdparty/cef
     - -Ithirdparty/cef/include
     - -Wno-c++17-extensions
+
+# On macOS builds, Windows/Linux platform sources are not compiled. Ignore them
+# so clangd does not try to parse windows.h / Linux headers with the Mac SDK.
+---
+If:
+  PathMatch: src/platform/win/.*
+CompileFlags:
+  Add:
+    - -Wno-everything
+  Remove:
+    - -xobjective-c++
+---
+If:
+  PathMatch: src/platform/linux/.*
+CompileFlags:
+  Add:
+    - -Wno-everything
+  Remove:
+    - -xobjective-c++