Credential storage

Ship Spec stores API keys in the OS keychain with per-project namespaces.

Platform	Backend
macOS	Keychain
Windows	Credential Manager
Linux	Secret Service (libsecret)

Namespacing:

• Service names: ship-spec (global) or ship-spec:{16-char-hash} (per-project)
• Prevents keys from leaking across projects