Resolves the user’s home directory cross-platform: HOME (Unix/macOS),
falling back to USERPROFILE (Windows), falling back to the current
directory if neither is set — without this fallback, Windows deployments
silently resolve config/credential paths to . (cwd) instead of erroring
or using the user’s actual profile directory.
Persists a credential to the OS-native keychain when available (macOS
Keychain, Windows Credential Manager, Linux Secret Service via the
keyring crate), falling back to an AES-256-GCM-encrypted local file
when the platform backend is unavailable (e.g. no D-Bus secret-service
daemon running, common in minimal containers) — REQ-2.3.5.