fix(config): never let app.json I/O stop startup or skip releasing the workspace

An app.json that exists but cannot be read, or a .bak that cannot be written,
now yields defaults instead of an unhandled exception before the main window
exists. A failed write at exit is logged and ignored, and the session is
disposed in a finally block, so the lock and connection are always released.

YKanBan.Tests/Storage/AppData/AppConfigStoreTests.cs

@@ -45,6 +45,43 @@ public class AppConfigStoreTests
         Assert.AreEqual("{ this is not valid json", File.ReadAllText(path + ".bak"));
     }
 
+    [TestMethod]
+    public void LoadUnreadableFileReturnsDefaults()
+    {
+        using var directory = new TempDirectory();
+        string path = Path.Combine(directory.FullPath, "app.json");
+        File.WriteAllText(path, "{ \"language\": \"zh-Hans\" }");
+        var store = new AppConfigStore(path);
+
+        AppConfig config;
+        using (new FileStream(path, FileMode.Open, FileAccess.ReadWrite, FileShare.None))
+        {
+            config = store.Load();
+        }
+
+        Assert.AreEqual(AppConfig.DefaultLanguage, config.Language);
+        Assert.IsFalse(File.Exists(path + ".bak"));
+    }
+
+    [TestMethod]
+    public void LoadCorruptFileReturnsDefaultsWhenTheBackupCannotBeWritten()
+    {
+        using var directory = new TempDirectory();
+        string path = Path.Combine(directory.FullPath, "app.json");
+        File.WriteAllText(path, "{ this is not valid json");
+        File.WriteAllText(path + ".bak", "older backup");
+        var store = new AppConfigStore(path);
+
+        AppConfig config;
+        using (new FileStream(path + ".bak", FileMode.Open, FileAccess.ReadWrite, FileShare.None))
+        {
+            config = store.Load();
+        }
+
+        Assert.AreEqual(AppConfig.CurrentFormatVersion, config.Version);
+        Assert.AreEqual("older backup", File.ReadAllText(path + ".bak"));
+    }
+
     [TestMethod]
     public void LoadJsonNullReturnsDefaults()
     {