feat: [P3] Keychain integration for secrets (macOS keychain, Linux secret-service)

[Railly]

Closes #21

Summary

• add macOS security and Linux secret-tool wrappers for sunat keychain set/get/list/clear
• resolve secrets through env var first, then keychain, then clear errors
• document keychain usage in SKILL.md

Verification

• bun run --cwd packages/cli test
• bun run --cwd packages/cli check (fails on pre-existing Biome diagnostics outside this slice after applying formatter changes)
• security find-generic-password -s sunat-cli -a CPE_CERT_PASSWORD -w returned the test value after sunat keychain set
• env override probe returned the env value while keychain also had a value

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sunat-cli-website	Ready	Preview, Comment	May 2, 2026 5:58am