Secret storage for DeepSeek API keys.
Provides a small abstraction (KeyringStore) plus a default
file-based implementation (FileKeyringStore), an opt-in OS keyring
implementation (DefaultKeyringStore), and an in-memory store for tests
(InMemoryKeyringStore).
Higher-level lookup through [Secrets::resolve] checks the secret store first
and falls back to environment variables. Config-file precedence lives in the
config crate so user-facing commands can keep config -> secret store -> env
explicit at the call site.