refactor(host): tokens live in a file under the data root (U0e)

D-63: the 0700 data root is the trust boundary already (I-1: hidden, not
locked), so the OS keyring added no wall and cost headless servers a D-Bus
session, CI a knob and every OS its own store. The file keeper is the only
store: run/tokens/, 0600, written atomically. The three keyring stores, the
file_keyring knob and their tests are removed; an unreadable token file is an
error, never no token.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

crates/ledger-gui/src/owner.rs

@@ -339,7 +339,7 @@ impl OwnerMenu {
                         if ui
                             .button(format!("{} Connect {}", icon::PLUGS_CONNECTED, agent.label()))
                             .on_hover_text(format!(
-                                "Let {} reach these books (it keeps their token in this computer's keyring)",
+                                "Let {} reach these books (it keeps their token in a file in the data root)",
                                 agent.label()
                             ))
                             .clicked()