wiretap v0.2.11

wiretap v0.2.11

This release makes repeat relay connections convenient without treating every
secret the same. Relay-admin access and the desktop's long-lived client
identity now use the operating system's credential storage where appropriate.

Saved relay administration

The GUI can remember multiple relay-server connections by name. A saved
profile contains:

• A user-chosen profile name.
• The canonical relay URL.
• Its last-used timestamp.
• An admin token stored separately in the operating system keyring.

The profile picker supports any number of saved relays and makes reconnecting
or forgetting one explicit. Temporary connections remain available. If the
keyring cannot store an admin token, wiretap keeps the active connection only
for the current session and does not write a plaintext fallback.

Supported secure backends are macOS Keychain, Windows Credential Manager,
Secret Service, KWallet, and pass. The encrypted-file and Linux KeyCtl
backends are deliberately excluded for saved admin profiles.

Keyring-first desktop identity

The relay client token used for automatic tunnel startup now benefits from a
separate keyring service. On registration, wiretap first attempts to store the
token there. The local relay-credentials.json then contains only the client
ID, project list, and an opaque keyring reference.

Existing credentials need no manual migration. The first successful load with
a supported keyring moves the plaintext token out of the JSON file while
preserving the client ID and all project assignments.

Headless hosts are intentionally different from relay administration. A client
token is required for unattended tunnel startup, and many servers have no
desktop keyring. When no supported keyring is available, wiretap automatically
retains the previous mode-0600 credentials file instead of disabling the
tunnel. There is no storage-mode setting to configure. GUI Settings reports
which storage path was selected.

Consistent CLI and GUI behavior

All client-credential paths now use the same manager:

• wiretap relay register --save
• wiretap relay projects add
• wiretap relay projects remove
• GUI registration and project management
• GUI and TUI tunnel startup

This removes the old CLI registration writer that bypassed credential-storage
policy. Admin tokens and client tokens use separate keyring services and
accounts, so forgetting a relay-admin profile cannot disturb the desktop
tunnel identity.

Upgrade notes

• No relay-server or database migration is required.
• Existing plaintext client credentials continue to work and migrate
  automatically when a keyring becomes available.
• A keyring reference requires access to the same operating-system user's
  credential store. On machines that never provide one, wiretap continues to
  use the protected credentials file.
• Saved relay-admin profiles from v0.2.10-compatible builds continue to use the
  same service name and remain available.

Full changelog: v0.2.10...v0.2.11