Show missing-credentials indicator for remote server sources

After reinstalling the app and importing sources from iCloud, remote
server instances with Keychain-only credentials showed no indication
that login is needed, unlike WebDAV/SMB sources.

- Show the orange key icon for Yattee Server instances without stored
  basic auth credentials (auth is always required for this type)
- Persist usesBasicAuth/usesAccountLogin flags on Instance (synced via
  iCloud) so missing Invidious/Piped/PeerTube credentials are detectable
  too; maintained on credential save/delete, login/logout, and legacy
  migration
- Centralize the check in AppEnvironment.needsCredentials(for:) used by
  SourcesListView, MediaSourcesView, and SourceRow
- Backfill the flags at launch from credentials currently in the
  Keychain so existing setups publish them without a re-login

Yattee/Models/Instance.swift

@@ -76,6 +76,16 @@ struct Instance: Identifiable, Codable, Hashable, Sendable {
     /// Whether to route video streams through this instance instead of connecting directly to YouTube CDN.
     var proxiesVideos: Bool
 
+    /// Whether this instance sits behind an HTTP Basic Auth reverse proxy.
+    /// Set when basic auth credentials are stored, so a missing Keychain entry
+    /// (e.g. after reinstalling and importing sources from iCloud) can be detected.
+    /// Yattee Server always requires basic auth regardless of this flag.
+    var usesBasicAuth: Bool
+
+    /// Whether the user has logged into an account on this instance (Invidious/Piped).
+    /// Set on login, so a missing Keychain credential can be detected after reinstall.
+    var usesAccountLogin: Bool
+
     // MARK: - Initialization
 
     init(
@@ -87,7 +97,9 @@ struct Instance: Identifiable, Codable, Hashable, Sendable {
         dateAdded: Date = Date(),
         apiKey: String? = nil,
         allowInvalidCertificates: Bool = false,
-        proxiesVideos: Bool = false
+        proxiesVideos: Bool = false,
+        usesBasicAuth: Bool = false,
+        usesAccountLogin: Bool = false
     ) {
         self.id = id
         self.type = type
@@ -98,6 +110,8 @@ struct Instance: Identifiable, Codable, Hashable, Sendable {
         self.apiKey = apiKey
         self.allowInvalidCertificates = allowInvalidCertificates
         self.proxiesVideos = proxiesVideos
+        self.usesBasicAuth = usesBasicAuth
+        self.usesAccountLogin = usesAccountLogin
     }
 
     init(from decoder: Decoder) throws {
@@ -111,6 +125,8 @@ struct Instance: Identifiable, Codable, Hashable, Sendable {
         apiKey = try container.decodeIfPresent(String.self, forKey: .apiKey)
         allowInvalidCertificates = try container.decode(Bool.self, forKey: .allowInvalidCertificates)
         proxiesVideos = try container.decodeIfPresent(Bool.self, forKey: .proxiesVideos) ?? false
+        usesBasicAuth = try container.decodeIfPresent(Bool.self, forKey: .usesBasicAuth) ?? false
+        usesAccountLogin = try container.decodeIfPresent(Bool.self, forKey: .usesAccountLogin) ?? false
     }
 
     // MARK: - Computed Properties