fix(cli): platform-specific keychain store hints after login (#235)

[adriannoes]

Summary

• Add auth_keychain_hints.py with platform-specific remediation text when pipefy auth login succeeds at OAuth but store_session fails.
• On macOS, surface errSecParam (-25244) and the Terminal.app + Always Allow ACL workaround instead of the headless Linux Secret Service hint.
• Keep the existing Linux Secret Service / PIPEFY_KEYCHAIN_BACKEND=file hint and add a Windows Credential Manager variant.
• Document the macOS first-run keychain ACL flow in docs/cli/auth.md.

Closes #235.

[gbrlcustodio]

suggestion (non-blocking): "Independent of how pipefy was installed" reads as "grant once, forever" to the reader who lands here after a failure. That holds for uv tool install and wheel installs (stable Python interpreter path, so the macOS keychain ACL persists), but uvx uses cached ephemeral environments whose binary path can change after uvx --refresh or a uv version bump. When the path changes, the existing Always Allow grant no longer applies and the next write surfaces the same errSecParam. Worth qualifying so uvx users don't conclude the workaround silently broke.

Suggested rewrite of the trailing sentence:

The remediation procedure is the same regardless of install method. macOS binds the keychain ACL to the calling Python binary's path, so uv tool install and a wheel install give you a stable grant; with uvx, the cached environment's binary path can change (for example after uvx --refresh or a uv version bump), and macOS will prompt again from Terminal.app.

[gbrlcustodio]

nitpick (non-blocking): the three Darwin rows run the same call against the same patched platform.system three times to assert three substrings of one hint. The same shape leaves no symmetric check that the Linux or Windows hints don't accidentally pick up another platform's wording.

Consider collapsing to one row per platform with required/forbidden fragment lists:

@pytest.mark.parametrize(
    ("system", "required", "forbidden"),
    [
        ("Darwin", ["errSecParam", "Terminal.app", "Always Allow"], ["Secret Service"]),
        ("Linux", ["Secret Service"], ["Terminal.app", "Credential Manager"]),
        ("Windows", ["Credential Manager"], ["Secret Service", "Terminal.app"]),
        ("FreeBSD", ["pipefy auth status"], []),
    ],
)

The CLI test in test_auth_login.py already covers cross-platform leakage at the integration layer, so this is a readability cleanup, not a coverage gap.

[gbrlcustodio]

nitpick (non-blocking): every other module in commands/ without a leading underscore registers a Typer app and is a public CLI surface; the one existing helper (_common.py) carries the underscore. This module is also a helper (one function, called only from auth.py), so the name is slightly inconsistent with the directory convention.

Consider renaming to _auth_keychain_hints.py and updating the two import sites (commands/auth.py and tests/test_auth_keychain_hints.py). The test filename can stay as-is; pytest discovery doesn't require name parity with the SUT.

Defer freely; this is a one-time naming nit, not a coverage or correctness concern.

[gbrlcustodio]

Inline notes are all non-blocking; nothing here blocks merge.