refactor(host): tokens live in a file under the data root (U0e)

D-63: the 0700 data root is the trust boundary already (I-1: hidden, not
locked), so the OS keyring added no wall and cost headless servers a D-Bus
session, CI a knob and every OS its own store. The file keeper is the only
store: run/tokens/, 0600, written atomically. The three keyring stores, the
file_keyring knob and their tests are removed; an unreadable token file is an
error, never no token.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

crates/ledger-cli/tests/common/mod.rs

@@ -16,7 +16,7 @@
 //!      the test temp dir finds it), made by `wanderbooks setup --home`;
 //!      its server runs with an empty environment but PATH, and HOME and
 //!      XDG_CONFIG_HOME inside the home, on that home's root alone: never
-//!      this account's root, keyring, or sockets.
+//!      this account's root, tokens, or sockets.
 //!   2. A server is ended by its own child's PID, never by a search.
 //!   3. Settings a test gives as a settings file's text go into the books
 //!      as an agent puts them there: the changes ledger-config's import