[Feature]: Agent bus token persistence on Linux without OS keychain

[rosspeili]

One-line summary

On Linux, persist the agent bus token reliably when no OS keychain backend is available (headless, WSL, minimal distros).

Problem / motivation

#6 stores the bus token in encrypted agent-bus.json via electron/agent-bus-token.cjs, using the OS keychain where available. On some Linux setups keychain APIs are missing or fail silently, causing token regeneration on every launch and breaking MCP/HTTP clients configured with a copied token.

Proposed solution

1. Detect keychain availability at startup; log a clear Settings → Agents message when falling back.
2. Document supported secret stores (libsecret, kwallet) and the file-only fallback behavior (encrypted at rest with machine-local key derivation — specify algorithm in [Docs]: Add SECURITY.md with vulnerability reporting #26 / SECURITY follow-up).
3. Optional: Settings toggle “Pin token until I regenerate” vs “Rotate on each launch” for dev-only workflows (default secure).

Alternatives considered

• Require manual token paste every session — acceptable for dev but poor for automation.
• Plaintext token file — reject; keep encryption even on fallback.

Primary surface

Settings / persistence

Constraints you accept

• Should stay usable offline / local-first
• Browser-only mode may remain limited vs Electron

Mock / sketch / reference (optional)

Test matrix: Ubuntu + GNOME Keyring, KDE Wallet, Docker/WSL without secret service, npm run dev:desktop.