refactor(credstore): embed credential store and drop sdk-go dependency

- Embed the minimal credstore subset used by tea (SecureStore,
  EncryptedFileStore, KeyringStore, FileStore) as modules/credstore so
  external SDK renames can no longer break the build
- Keep the on-disk format fully compatible: AES-256-GCM values with the
  v1: prefix, credentials.json / credentials.json.enc paths, and the
  Token JSON field names are unchanged, verified by a ciphertext fixture
  generated with sdk-go v1.1.0
- Store the keyring master key under a tea-owned account name
- Reuse the existing kernel-level filelock module instead of the
  upstream lockfile protocol, removing a stale-lock race
- Cover roundtrip, keyring-unavailable fallback, and fixture decryption
  with tests using a mocked keyring
- Remove github.com/go-signet/sdk-go and promote
  github.com/zalando/go-keyring to a direct dependency

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/credstore/store_test.go

@@ -0,0 +1,89 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestTokenIsExpired(t *testing.T) {
+	tests := []struct {
+		name      string
+		expiresAt time.Time
+		want      bool
+	}{
+		{
+			name:      "expired token",
+			expiresAt: time.Now().Add(-1 * time.Hour),
+			want:      true,
+		},
+		{
+			name:      "not expired token",
+			expiresAt: time.Now().Add(1 * time.Hour),
+			want:      false,
+		},
+		{
+			name:      "zero expiry (no expiry)",
+			expiresAt: time.Time{},
+			want:      false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			token := &Token{
+				AccessToken: "test-token",
+				ExpiresAt:   tt.expiresAt,
+			}
+			assert.Equal(t, tt.want, token.IsExpired())
+		})
+	}
+}
+
+func TestTokenIsValid(t *testing.T) {
+	tests := []struct {
+		name        string
+		accessToken string
+		expiresAt   time.Time
+		want        bool
+	}{
+		{
+			name:        "valid token with future expiry",
+			accessToken: "test-token",
+			expiresAt:   time.Now().Add(1 * time.Hour),
+			want:        true,
+		},
+		{
+			name:        "valid token with zero expiry",
+			accessToken: "test-token",
+			expiresAt:   time.Time{},
+			want:        true,
+		},
+		{
+			name:        "expired token",
+			accessToken: "test-token",
+			expiresAt:   time.Now().Add(-1 * time.Hour),
+			want:        false,
+		},
+		{
+			name:        "empty access token",
+			accessToken: "",
+			expiresAt:   time.Now().Add(1 * time.Hour),
+			want:        false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			token := &Token{
+				AccessToken: tt.accessToken,
+				ExpiresAt:   tt.expiresAt,
+			}
+			assert.Equal(t, tt.want, token.IsValid())
+		})
+	}
+}