refactor(credstore): embed credential store and drop sdk-go dependency

- Embed the minimal credstore subset used by tea (SecureStore,
  EncryptedFileStore, KeyringStore, FileStore) as modules/credstore so
  external SDK renames can no longer break the build
- Keep the on-disk format fully compatible: AES-256-GCM values with the
  v1: prefix, credentials.json / credentials.json.enc paths, and the
  Token JSON field names are unchanged, verified by a ciphertext fixture
  generated with sdk-go v1.1.0
- Store the keyring master key under a tea-owned account name
- Reuse the existing kernel-level filelock module instead of the
  upstream lockfile protocol, removing a stale-lock race
- Cover roundtrip, keyring-unavailable fallback, and fixture decryption
  with tests using a mocked keyring
- Remove github.com/go-signet/sdk-go and promote
  github.com/zalando/go-keyring to a direct dependency

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/credstore/keyring_store_test.go

@@ -0,0 +1,81 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/zalando/go-keyring"
+)
+
+func TestKeyringStoreSaveAndLoad(t *testing.T) {
+	keyring.MockInit()
+	store := NewStringKeyringStore("test-service")
+
+	require.NoError(t, store.Save("my-client", "eyJhbGciOiJSUzI1NiJ9"))
+
+	loaded, err := store.Load("my-client")
+	require.NoError(t, err)
+	assert.Equal(t, "eyJhbGciOiJSUzI1NiJ9", loaded)
+}
+
+func TestKeyringStoreLoadNotFound(t *testing.T) {
+	keyring.MockInit()
+	store := NewStringKeyringStore("test-service")
+
+	_, err := store.Load("nonexistent")
+	assert.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestKeyringStoreDelete(t *testing.T) {
+	keyring.MockInit()
+	store := NewStringKeyringStore("test-service")
+
+	require.NoError(t, store.Save("test-client", "test-token"))
+	require.NoError(t, store.Delete("test-client"))
+
+	_, err := store.Load("test-client")
+	assert.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestKeyringStoreDeleteNonexistent(t *testing.T) {
+	keyring.MockInit()
+	store := NewStringKeyringStore("test-service")
+
+	// Should not error when deleting nonexistent key
+	assert.NoError(t, store.Delete("nonexistent"))
+}
+
+func TestKeyringStoreOverwriteExisting(t *testing.T) {
+	keyring.MockInit()
+	store := NewStringKeyringStore("test-service")
+
+	require.NoError(t, store.Save("test-client", "token-v1"))
+	require.NoError(t, store.Save("test-client", "token-v2"))
+
+	loaded, err := store.Load("test-client")
+	require.NoError(t, err)
+	assert.Equal(t, "token-v2", loaded)
+}
+
+func TestKeyringStoreSaveEmptyClientID(t *testing.T) {
+	keyring.MockInit()
+	store := NewStringKeyringStore("test-service")
+
+	err := store.Save("", "tok")
+	assert.ErrorIs(t, err, ErrEmptyClientID)
+}
+
+func TestKeyringStoreString(t *testing.T) {
+	store := NewStringKeyringStore("my-service")
+	assert.Equal(t, "keyring: my-service", store.String())
+}
+
+func TestKeyringStoreNilCodecPanics(t *testing.T) {
+	assert.Panics(t, func() {
+		NewKeyringStore[string]("svc", nil)
+	})
+}