SonarDesk 2.2 Release Hardening

This build hardens the existing 2.1 iCloud-enabled application without changing its storage layout.

Implemented

Hardened Runtime and App Sandbox remain enabled for Release.
Release uses whole-module optimisation and product validation.
iCloud Drive JSON writes are file-coordinated and atomic.
Existing iCloud data files receive rolling backups in Backups (last 10 per data file).
iCloud reads detect files that are not downloaded instead of silently treating them as missing.
Report writes are coordinated and atomic; corrupt reports are preserved and reported rather than silently discarded.
Report deletion now surfaces filesystem errors.
SonarQube GET requests retry transient transport, 429, and 5xx failures with bounded backoff.
Authentication failures have a specific user-facing error.
Server URLs are normalised and reject credentials/query/fragment data.
Duplicate SonarQube server URLs are rejected.
Tokens remain in synchronisable Keychain and never enter iCloud Drive JSON.
Version bumped to 2.2.0 (build 6).

A final archive still has to be compiled with Apple Xcode because this environment does not contain the macOS SDK/Xcode. Before distribution:

Select the correct Apple Developer Team and confirm iCloud.net.absdev.SonarDesk is enabled for the App ID.
Build the Release configuration with zero compiler errors.
Archive with Developer ID Application signing.
Notarize the archive and staple the notarization ticket.
Test the signed/notarized build from a clean user account or second Mac, including iCloud Drive, Keychain, server add/edit/delete, reports, offline launch, and reconnect.