Show missing-credentials indicator for remote server sources

After reinstalling the app and importing sources from iCloud, remote
server instances with Keychain-only credentials showed no indication
that login is needed, unlike WebDAV/SMB sources.

- Show the orange key icon for Yattee Server instances without stored
  basic auth credentials (auth is always required for this type)
- Persist usesBasicAuth/usesAccountLogin flags on Instance (synced via
  iCloud) so missing Invidious/Piped/PeerTube credentials are detectable
  too; maintained on credential save/delete, login/logout, and legacy
  migration
- Centralize the check in AppEnvironment.needsCredentials(for:) used by
  SourcesListView, MediaSourcesView, and SourceRow
- Backfill the flags at launch from credentials currently in the
  Keychain so existing setups publish them without a re-login

Yattee/Views/MediaBrowser/MediaSourcesView.swift

@@ -40,6 +40,12 @@ struct MediaSourcesView: View {
         appEnvironment?.settingsManager.listStyle ?? .inset
     }
 
+    /// Whether a remote server instance requires credentials that are missing from
+    /// the Keychain (e.g. after reinstalling and importing sources from iCloud).
+    private func needsCredentials(_ instance: Instance) -> Bool {
+        appEnvironment?.needsCredentials(for: instance) ?? false
+    }
+
     var body: some View {
         Group {
             #if os(tvOS)
@@ -517,6 +523,12 @@ struct MediaSourcesView: View {
                 Text("\(instance.type.displayName) - \(instance.url.host ?? instance.url.absoluteString)")
                     .font(.caption)
                     .foregroundStyle(.secondary)
+
+                if needsCredentials(instance) {
+                    Label(String(localized: "sources.status.authRequired"), systemImage: "key.fill")
+                        .font(.caption2)
+                        .foregroundStyle(.orange)
+                }
             }
 
             Spacer()