Show missing-credentials indicator for remote server sources

After reinstalling the app and importing sources from iCloud, remote
server instances with Keychain-only credentials showed no indication
that login is needed, unlike WebDAV/SMB sources.

- Show the orange key icon for Yattee Server instances without stored
  basic auth credentials (auth is always required for this type)
- Persist usesBasicAuth/usesAccountLogin flags on Instance (synced via
  iCloud) so missing Invidious/Piped/PeerTube credentials are detectable
  too; maintained on credential save/delete, login/logout, and legacy
  migration
- Centralize the check in AppEnvironment.needsCredentials(for:) used by
  SourcesListView, MediaSourcesView, and SourceRow
- Backfill the flags at launch from credentials currently in the
  Keychain so existing setups publish them without a re-login

Yattee/Core/InstancesManager.swift

@@ -174,6 +174,26 @@ final class InstancesManager {
         }
     }
 
+    /// Records whether an instance sits behind HTTP Basic Auth.
+    /// Persisted (and synced to iCloud) so missing Keychain credentials can be
+    /// detected after a reinstall.
+    func setUsesBasicAuth(_ value: Bool, for instance: Instance) {
+        guard let index = instances.firstIndex(where: { $0.id == instance.id }),
+              instances[index].usesBasicAuth != value else { return }
+        instances[index].usesBasicAuth = value
+        saveInstances()
+    }
+
+    /// Records whether the user has logged into an account on an instance.
+    /// Persisted (and synced to iCloud) so missing Keychain credentials can be
+    /// detected after a reinstall.
+    func setUsesAccountLogin(_ value: Bool, for instance: Instance) {
+        guard let index = instances.firstIndex(where: { $0.id == instance.id }),
+              instances[index].usesAccountLogin != value else { return }
+        instances[index].usesAccountLogin = value
+        saveInstances()
+    }
+
     /// Sets the given instance as the primary (first) instance.
     func setPrimary(_ instance: Instance) {
         LoggingService.shared.debug("[InstancesManager] setPrimary called for: \(instance.displayName)", category: .general)