Three review findings on the import flow:

- Profile discovery accepted any entry named `Cookies`, so a directory listed
  as an importable profile and then failed the SQLite open; the fallback scan
  and the installed check now require a regular file.
- A "new profile" target chosen before the profile cap was reached could still
  be imported once it was, creating a profile past the limit; the Import
  button now disables in that case.
- `keychainItemMissing` told the user to sign in and retry but offered no
  retry — it is now retryable, since signing in is exactly what creates the key.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>