Without Secret Service, the "system" store lands in a per-session kernel keyring #577

Environment: @doist/todoist-cli 5.4.5, @doist/todoist-sdk 15.3.1, Node 24.21.0, Linux (WSL2).

Related to #424, which covers a different failure of the same fallback.

On Linux with no Secret Service on the session bus (WSL2 here), td auth token <token> prints:

Token stored securely in the system credential manager

The key is written to the kernel keyring of the current login session (/proc/keys shows user keyring:user-<id>@todoist-cli linked under a _ses keyring). A process in another session then fails:

Error: AUTH_STORE_READ_FAILED
system credential manager returned no credential for the stored account; the keyring entry may have been removed externally.

That covers a second terminal, a cron job and anything after a WSL restart. Reproduce the second session with keyctl new_session (or the KEYCTL_JOIN_SESSION_KEYRING syscall) then td auth status.

Suggested fix: after a system-store write, read the credential back from a fresh session keyring or detect the keyutils backend, and fail with the same guidance #424 added (suggest --credential-store=plaintext).