🩹 fix(auth): distinguish 'stored but unreadable' credentials from 'none' (#746)

[ryancheley]

Closes #746.

Not a 0.24.5 regression (verified)

The report attributed a credential-read break to the 0.24.5 security work. The diff disproves that:

• security.py, config.py, models.py (all credential storage/read code) are byte-identical to 0.24.4.
• The auth.py change in 0.24.5 is only the http:// warning in verify_credentials() — a different method, not on the load_credentials() path.
• uv.lock changed only the youtrack-cli version; no dependency (keyring/pydantic/cryptography) moved.
• An in-process keyring store→load round-trip on 0.24.5 reads the token back correctly.

Actual cause: OS keychain behavior — Keychain items are access-bound to the binary that created them, so uv tool upgrade (which rebuilds the tool venv with a new python path) can cause the OS to deny the new binary access to the saved token. keyring.get_password then returns None, load_credentials() returns None, and you see AUTH_004. Re-running yt auth login re-stores under the new binary. This is independent of 0.24.5's contents.

What this PR does (the actionable part of #746)

Adds AuthManager.credentials_stored_but_unreadable() and uses it in yt auth status so the "credentials present but unreadable" case is no longer misreported as "no credentials found":

⚠ Credentials are stored in the system keyring but can't be read.
This can happen after upgrading or moving the CLI — the OS keychain may no
longer grant the new binary access to the saved token.
Run 'yt auth login' to re-store your credentials.

Detection: config records a keyring-backed login (YOUTRACK_API_KEY=[Stored in keyring] + base URL) but load_credentials() returns None.

Tests

tests/test_auth.py::TestCredentialsStoredButUnreadable — flags the placeholder+unreadable case, and does not flag readable creds or a clean/no-creds config. Full suite: 1402 passed.

🤖 Generated with Claude Code

[github-actions]

Profile summary:

GitHub user: ryancheley
🟢 No concerns found with user's profile.
🟢 No concerns found with recent PR activity.
🟢 No concerns found with recent issue activity.

For a more detailed report, run `gh-profiler ryancheley`.