Patch macOS keychain handling for CEF builds

Adds a macOS post-build step to patch CEF’s keychain service string to a Nebula-specific name, then re-sign the modified framework (with configurable signing identity or ad-hoc). Also enables Chromium’s `use-mock-keychain` switch on Apple builds to prevent repeated local keychain prompts, fixes titlebar traffic-light hit testing in the mac window view, scopes a WM_CLOSE guard to Windows only, and updates `.clangd` to ignore non-mac platform sources during macOS development.

CMakeLists.txt

@@ -296,6 +296,33 @@ function(add_nebula_app_target nebula_target entry_source)
                 VERBATIM
             )
         endforeach()
+
+        # Give Nebula its own OSCrypt keychain service name, then resign so the
+        # patched framework still loads. Optional stable identity:
+        #   cmake -DNEBULA_CODESIGN_IDENTITY="Apple Development: ..."
+        set(NEBULA_CODESIGN_IDENTITY "" CACHE STRING
+            "codesign identity for macOS app bundles (empty = ad-hoc)")
+        if(NEBULA_CODESIGN_IDENTITY)
+            set(_nebula_codesign_identity "${NEBULA_CODESIGN_IDENTITY}")
+        else()
+            set(_nebula_codesign_identity "-")
+        endif()
+        find_package(Python3 COMPONENTS Interpreter REQUIRED)
+        set(_nebula_cef_framework
+            "${NEBULA_APP}/Contents/Frameworks/Chromium Embedded Framework.framework")
+        set(_nebula_cef_binary
+            "${_nebula_cef_framework}/Versions/Current/Chromium Embedded Framework")
+        add_custom_command(TARGET ${nebula_target} POST_BUILD
+            COMMAND ${Python3_EXECUTABLE}
+                "${CMAKE_SOURCE_DIR}/cmake/macos_patch_cef_keychain.py"
+                "${_nebula_cef_binary}"
+            COMMAND codesign --force --sign "${_nebula_codesign_identity}" --timestamp=none
+                "${_nebula_cef_binary}"
+            COMMAND codesign --force --sign "${_nebula_codesign_identity}" --timestamp=none
+                "${_nebula_cef_framework}"
+            COMMENT "Patching CEF keychain service name and resigning framework"
+            VERBATIM
+        )
     endif()
 
     # ------------------------------------------------------------