Launcher: panel accounts via authlib-injector, skin & cape editor

Microsoft sign-in is gone. Server accounts now receive Yggdrasil tokens
from the panel and launch with authlib-injector pointed at the panel's
auth server, so online-mode servers verify players against it.

- Download authlib-injector from the panel mirror (fallback: official),
  SHA-256 verified and cached, with prefetched metadata
- New Skin & cape settings tab: upload, arm style, reset, cape picker
  with front/back previews
- Avatars render from the panel's head endpoint

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ARcGWxLx21FwXJ3yfGriS

launcher/src-tauri/src/secrets.rs

@@ -1,4 +1,4 @@
-//! Encrypted storage for tokens (panel sessions, Microsoft refresh tokens).
+//! Encrypted storage for tokens (panel sessions and game sessions).
 //!
 //! Secrets live in `secrets.bin`, encrypted with ChaCha20-Poly1305. The key
 //! is kept in the OS credential store (Windows Credential Manager / macOS
@@ -18,11 +18,11 @@ use std::sync::Mutex;
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(default)]
 pub struct Secret {
+    /// Panel API session (manifest, account/skin API).
     pub panel_token: Option<String>,
-    pub ms_refresh_token: Option<String>,
-    pub mc_access_token: Option<String>,
-    pub mc_expires_at: i64,
-    pub xuid: Option<String>,
+    /// Game session from the panel's Yggdrasil server.
+    pub ygg_access_token: Option<String>,
+    pub ygg_client_token: Option<String>,
 }
 
 pub struct Secrets {