#20 feat: abstract key storage, in-memory fallback for non-linux platforms

Fixes lixmal/keepass4web-rs#288.

Problem

keepass::key depended directly on linux-keyutils, so the server could only run on Linux (or in Docker), and linux_keyutils::KeyError leaked into the HTTP layer's error handling.

Design

• SecretKey's public API is unchanged; the backing store is now a private module selected at compile time:
  • linux: the existing kernel keyring implementation (unchanged behavior, including timeouts and permissions)
  • other platforms: an in-memory store — secrets zeroized on drop, per-key expiry refreshed on retrieve, expired entries pruned on store. Weaker than a kernel keyring (keys live in process memory) but it makes native macOS/Windows development possible; documented in the module
• new crate-local KeyUnavailableError replaces linux_keyutils::KeyError in the HTTP layer (missing/expired/revoked → treated as 'db closed' → 401, everything else → 500), removing the platform type leak
• linux-keyutils moved to [target.'cfg(target_os = "linux")'.dependencies]

Testing

• cargo test on Linux: 11/11 — the keyring path via the existing key_roundtrip, plus the memory store (compiled under cfg(test) on all platforms) gets roundtrip/revoke/expiry tests
• cargo check --target aarch64-apple-darwin fails only on pre-existing C build-script deps (ring, zstd-sys) that need an Apple toolchain — unrelated to this change

---

Summary by cubic

Abstracted key storage: Linux keeps the kernel keyring; non-Linux platforms use an in-memory store. This enables native macOS/Windows runs and removes linux_keyutils errors from the HTTP layer.

• New Features

  • Compile-time backend: keyring on Linux; in-memory on others.
  • In-memory store: zeroized on drop, TTL refreshed on read, expired keys pruned on write.
  • Added crate-local KeyUnavailableError; HTTP maps missing/expired/revoked to 401, others to 500.

• Dependencies

  • Moved linux-keyutils to [target.'cfg(target_os = "linux")'.dependencies].