feat: password resolution via OS keychain and password_cmd

SecretStore trait with a keyring-backed implementation (macOS Keychain,
Windows Credential Manager, Linux Secret Service) under service
soulseek-rs. Precedence: --password/env > keychain > password_cmd from
config.toml. Keychain failures degrade to not-found so headless boxes
fall through to password_cmd.

soulseek-rs/src/main.rs

@@ -51,9 +51,15 @@ fn main() -> Result<()> {
         )
     })?;
 
-    let password = cli.password.clone().ok_or_else(|| {
+    let password = persist::secret::resolve_password(
+        cli.password.as_deref(),
+        resolved.username.as_deref(),
+        resolved.password_cmd.as_deref(),
+        &persist::secret::KeyringStore,
+    )
+    .ok_or_else(|| {
         color_eyre::eyre::eyre!(
-            "Password required: use --password or set SOULSEEK_PASSWORD env var"
+            "Password required: use --password, set SOULSEEK_PASSWORD, or store one in the OS keychain"
         )
     })?;