API keys need OS secure storage — safeStorage/keyring; config-file plaintext is interim

[kordless]

Straight answer (user asked to be told)

Hyperia has NO secure-secret storage implemented today. plan/keystore-secure-enclave.md (#103) designs it (the keyring crate over Keychain / Credential Manager / Secret Service) but nothing is wired. Ghost API keys are read from env-var chains only (sidecar/src/ghost/api.rs:338-340).

Interim (per user direction)

The Hyperia Agent config pane stores pasted provider API keys in the shared config file (hand-editable, config.agent.keys.*) with a clear "plaintext until keystore lands" note.

Fix

• Sidecar: keyring crate — store/fetch hyperia.agent.<provider> secrets in the OS store (Design 1 of EPIC: KeyStore — hardware secure-enclave backing for identity tokens #103, days not weeks).
• Config pane migrates: on first run with keyring available, move config.agent.keys.* values into the OS store and blank them in the file (leave "<stored in OS keystore>" marker).
• Related: EPIC: KeyStore — hardware secure-enclave backing for identity tokens #103 (enclave-backed identity tokens — bigger scope), Read-gating tiers + keep the token store unreadable by agents #96 (read-gating the token store).