refactor(host): tokens live in a file under the data root (U0e)

D-63: the 0700 data root is the trust boundary already (I-1: hidden, not
locked), so the OS keyring added no wall and cost headless servers a D-Bus
session, CI a knob and every OS its own store. The file keeper is the only
store: run/tokens/, 0600, written atomically. The three keyring stores, the
file_keyring knob and their tests are removed; an unreadable token file is an
error, never no token.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

crates/ledger-mcp/src/admin.rs

@@ -144,7 +144,7 @@ pub enum Request {
     },
     /// The live tokens.
     TokenList,
-    /// Whether a token kept elsewhere (this computer's keyring) is the
+    /// Whether a token kept elsewhere (its token file) is the
     /// live one of its books and name: asked by its SHA-256 alone, never
     /// its text (INVARIANT 6).
     TokenCheck {

crates/ledger-mcp/src/local.rs

@@ -255,7 +255,7 @@ impl Books {
         let Some(presented) = presented else {
             return Err((
                 crate::access::UNAUTHORIZED,
-                "these books need a token, and this request carried none: the human makes one with `wanderbooks token create` (if one was made, `wanderbooks token check` says whether this computer's keyring still gives it)"
+                "these books need a token, and this request carried none: the human makes one with `wanderbooks token create` (if one was made, `wanderbooks token check` says whether its token file still gives it)"
                     .into(),
             ));
         };