fix: remove Keychain accessGroup — fixes auth reset and health data

- Remove kSecAttrAccessGroup from KeychainService (requires entitlement
  that keeps getting stripped by Xcode)
- Basic Keychain works without accessGroup for the main app
- Fix health credentials migration check — use KeychainService.load directly
- Tokens now persist correctly between app launches

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

PulseWidget/KeychainService.swift

@@ -3,15 +3,13 @@ import Security
 
 enum KeychainService {
     static let service = "com.daniil.pulsehealth"
-    static let accessGroup = "V9AG8JTFLC.com.daniil.pulsehealth.shared"
 
     static func save(key: String, value: String) {
         guard let data = value.data(using: .utf8) else { return }
         let query: [String: Any] = [
             kSecClass as String: kSecClassGenericPassword,
             kSecAttrService as String: service,
-            kSecAttrAccount as String: key,
-            kSecAttrAccessGroup as String: accessGroup
+            kSecAttrAccount as String: key
         ]
         SecItemDelete(query as CFDictionary)
         var add = query
@@ -25,7 +23,6 @@ enum KeychainService {
             kSecClass as String: kSecClassGenericPassword,
             kSecAttrService as String: service,
             kSecAttrAccount as String: key,
-            kSecAttrAccessGroup as String: accessGroup,
             kSecReturnData as String: true,
             kSecMatchLimit as String: kSecMatchLimitOne
         ]
@@ -39,8 +36,7 @@ enum KeychainService {
         let query: [String: Any] = [
             kSecClass as String: kSecClassGenericPassword,
             kSecAttrService as String: service,
-            kSecAttrAccount as String: key,
-            kSecAttrAccessGroup as String: accessGroup
+            kSecAttrAccount as String: key
         ]
         SecItemDelete(query as CFDictionary)
     }