fix(auth): use singleton pattern for keyring store

Avoid multiple macOS Keychain prompts per process by caching the
opened keyring store with sync.Once. Adds ResetDefaultStore() for
test isolation.

Author: dedene

internal/auth/keyring.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"runtime"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/99designs/keyring"
@@ -50,6 +51,13 @@ var (
 	keyringOpenFunc        = keyring.Open
 )
 
+// Singleton store to avoid multiple keychain prompts per process.
+var (
+	defaultStore     Store
+	defaultStoreOnce sync.Once
+	defaultStoreErr  error
+)
+
 const keyringOpenTimeout = 5 * time.Second
 
 func openKeyring() (keyring.Keyring, error) {
@@ -157,12 +165,23 @@ func openKeyringWithTimeout(cfg keyring.Config, timeout time.Duration) (keyring.
 }
 
 func OpenDefault() (Store, error) {
-	ring, err := openKeyringFunc()
-	if err != nil {
-		return nil, err
-	}
+	defaultStoreOnce.Do(func() {
+		ring, err := openKeyringFunc()
+		if err != nil {
+			defaultStoreErr = err
+			return
+		}
+		defaultStore = &KeyringStore{ring: ring}
+	})
+
+	return defaultStore, defaultStoreErr
+}
 
-	return &KeyringStore{ring: ring}, nil
+// ResetDefaultStore resets the singleton store for testing.
+func ResetDefaultStore() {
+	defaultStoreOnce = sync.Once{}
+	defaultStore = nil
+	defaultStoreErr = nil
 }
 
 type storedToken struct {