feat: store OAuth tokens securely

Add bounded token response parsing with refresh-token retention and a cancellable worker-thread libsecret adapter using versioned credential payloads.

Verify CRUD, isolation, cancellation, corruption, unavailable service, redaction, and cleanup against an isolated D-Bus and gnome-keyring Secret Service in normal, warning-as-error, and sanitizer profiles.

tests/run_secret_store_test.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+
+set -eu
+
+if [ "$#" -ne 1 ] || [ ! -x "$1" ]; then
+    echo "secret-store test wrapper requires one executable" >&2
+    exit 2
+fi
+
+test_binary=$1
+
+exec dbus-run-session -- sh -eu -c '
+test_binary=$1
+test_root=$(mktemp -d "${TMPDIR:-/tmp}/nocal-secret-store.XXXXXX")
+test_home=$test_root/home
+test_runtime=$test_root/runtime
+mkdir -m 700 "$test_home" "$test_runtime"
+
+keyring_pid=
+cleanup() {
+    if [ -n "$keyring_pid" ]; then
+        kill "$keyring_pid" 2>/dev/null || true
+        wait "$keyring_pid" 2>/dev/null || true
+    fi
+    rm -rf "$test_root"
+}
+trap cleanup EXIT HUP INT TERM
+
+export HOME=$test_home
+export XDG_CONFIG_HOME=$test_home/.config
+export XDG_DATA_HOME=$test_home/.local/share
+export XDG_CACHE_HOME=$test_home/.cache
+export XDG_RUNTIME_DIR=$test_runtime
+mkdir -p "$XDG_CONFIG_HOME" "$XDG_DATA_HOME/keyrings" "$XDG_CACHE_HOME"
+
+password_pipe=$test_root/keyring-password
+mkfifo "$password_pipe"
+gnome-keyring-daemon --foreground --unlock --components=secrets \
+    <"$password_pipe" >"$test_root/keyring.out" 2>"$test_root/keyring.err" &
+keyring_pid=$!
+printf "\n" >"$password_pipe"
+rm "$password_pipe"
+
+if ! gdbus wait --session --timeout 5 org.freedesktop.secrets \
+        || ! kill -0 "$keyring_pid" 2>/dev/null; then
+    sed -n "1,80p" "$test_root/keyring.err" >&2 || true
+    echo "gnome-keyring Secret Service failed to start" >&2
+    exit 1
+fi
+
+"$test_binary"
+' sh "$test_binary"