pub const API_KEYRING_SENTINEL: &str = "__KEYRING__";
Secret-store routing metadata; never credential material.