feat: switchable secret storage backends + README demo video

[starvy]

Two things, both needed before going public.

1. README demo video

The README had no visual of the app. Adds a 55s recording (GIF 728K inline + MP4).

Recorded against a purpose-built workspace using only public, unauthenticated endpoints —
GitHub /zen, /octocat, /users/:u, /rate_limit for REST and the public Countries API for
GraphQL. No token anywhere, so no Authorization header is ever on screen. Beats: open a saved
request → Ctrl+Enter → {{variables}} resolving against an environment → switch env and re-send
→ headers + timing waterfall → a GraphQL query → the command palette.

Also documents the Linux -dev packages GPUI links against. A clean Ubuntu 24.04 box could not
build with the previously documented steps — it fails in yeslogic-fontconfig-sys with "The
pkg-config command could not be found", which reads as a toolchain problem, not a missing package.

2. Switchable secret storage

Secrets could only come from the OS keychain. On Linux that isn't a preference — a headless box,
container or CI runner has no Secret Service at all, so every {{secret:..}} failed with
org.freedesktop.DBus.Error.ServiceUnknown. Reproduced on the dev box this was built on.

The SecretResolver seam already existed; only the keychain was wired, and the desktop app
hardcoded KeyringSecrets at ~8 sites. Now, behind a WorkspaceSecrets facade selected by
[secrets] in settings.toml and overridable per run with POSEL_SECRET_BACKEND:

Backend	Writable	Where values live
keychain (default, unchanged)	yes	OS keychain
file	yes	0600 TOML in the user data dir, per-workspace, atomic writes
env	no	$POSEL_SECRET_<NAME> — for CI
command	no	stdout of pass/op/gh, git-credential-helper style
none	—	secrets off

Read-only backends drop the Secrets panel's write controls instead of offering a guaranteed
failure. App Settings gains a picker; posel-cli gains --secret-backend. Errors now distinguish
"not set" from "backend unavailable" — the latter is what tells a user to switch backend.

Secret values still never enter the workspace; only the {{secret:name}} reference is written
to .toml.

Review + verification

CI can't run (Actions credits exhausted — it goes green once this repo is public), so this was
verified locally and by an adversarial review pass, which found six real defects that are fixed
in d6f8734 — two security-relevant:

• the file backend chmod'ed 0600 after writing plaintext (measured 0664 under umask 002) and
  could strand a world-readable temp full of secrets; now created owner-only before a byte is written
• SecretsError::Parse interpolated toml's error, which quotes the offending source line — in this
  file that line is a secret, and it surfaced in UI toasts and CLI stderr
• the variables-grid secret→literal toggle wrote plaintext into the workspace on read-only backends
• the helper command ran unbounded on the UI thread (a pinentry prompt froze the app)
• AppSettings::load() ran per row per frame in the Secrets panel
• a typo'd backend name silently reset all settings

Verified:

• cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace → 401 passed, 0 failed
• Windows cross-compile (x86_64-pc-windows-gnu, clippy -D warnings) on storage/cli/core/template — this is what exercises the #[cfg(not(unix))] branch, which had never been compiled anywhere
• End-to-end on the wire: env, command and file backends each resolve into a real request's Authorization header; 0600 confirmed on disk with no stray temps
• GUI checked under Xvfb: the backend picker, and read-only backends correctly hiding write controls

macOS is not compile-verified (no SDK here), but it takes the same #[cfg(unix)] path as Linux and
the only macOS-specific surface — keyring's apple-native feature — is untouched.

Known, not fixed here

Two pre-existing bugs found while testing, worth follow-ups:

• macOS glyphs leak into the Linux/Windows UI — the default empty state reads "Press ⌘↵ to send" (4 sites bypass the existing keybinding_hint())
• no window_min_size; below ~900px the response footer overlaps itself