Secret storage for DeepSeek API keys.
Provides a small abstraction (KeyringStore) plus a default
implementation backed by the OS keyring (DefaultKeyringStore),
a file-based fallback for headless Linux (FileKeyringStore), and
an in-memory store for tests (InMemoryKeyringStore).
Higher-level lookup goes through [Secrets::resolve], which checks
the keyring first and falls back to environment variables. The
caller (typically the config crate) then falls back to plaintext
TOML if both are empty — that final layer lives outside this crate
so the precedence is explicit at the call site.
Hard rule: keyring → env → config-file. Never swap.