Phase 8: GUI Keys tab. Lists current user's enrolled FIDO2 credentials, enrolls a new key with a touch-prompt modal driven by the daemon's EnrollmentFailed signal (success comes from the call return), removes credentials per row, degrades gracefully to a Retry banner when the daemon is unreachable, and surfaces transient errors via adw::Toast. 8 tasks, 4 unit tests (error classifier).