Secure token storage (OS keychain)

[Bccorb]

Summary

Store session tokens in the operating system keychain rather than a plaintext file. The access token is short-lived, but the refresh token is the durable secret and must never touch disk in cleartext.

Tasks

• Keychain adapter with backends for macOS Keychain, Linux Secret Service (libsecret), and Windows Credential Manager.
• Store per profile: access token, refresh token, and expiries. Key entries by profile name and instance URL.
• Graceful, opt-in fallback and a clear error when no OS keychain is available (for example headless CI). Documented, not silent.
• Redact tokens from all logs and error output.

Acceptance criteria

• The refresh token is retrievable only through the keychain, never written to config or logs.
• Tokens are scoped per profile so multiple instances do not collide.
• Removing a profile clears its keychain entries.

References

The access token is short-lived; the refresh token persists and is the real theft target for a CLI. Related cross-platform keychain work for the secrets-manager CLI: fells-code/seamless-secrets#26.

Part of #38