Function install_credentials 

pub fn install_credentials(
    p: InstallParams<'_>,
) -> Result<InstallOutcome, CredentialError>

Install credentials atomically: writes the AES user key + X25519 device key first, then updates ~/.cinch/config.json with token / user_id / device_id / hostname / machine_id and bumps credential_version exactly once at the end.

This is the only function CLI / desktop should call when persisting a fresh sign-in. It guarantees the desktop FS watcher sees a fully-formed credential set on the version bump.