Redesign auth/session/server lifecycle: durable session, wallet-delegated, daemon-independent #186

Problem

gitd reimplemented identity/session/credential/server lifecycle on top of @enbox/auth instead of using the SDK's session model, which makes auth feel fragile:

• "Session" = daemon process lifetime, nothing persisted. Every command rebuilds an EnboxUserAgent + AuthManager, re-unlocks the vault, and re-configure()s all 11 protocols. A crash, a gitd upgrade, a reboot, or sleep silently drops the session. restoreSession() is never used.
• The daemon is load-bearing for auth only because the LevelDB vault is single-writer. One process holds the unlocked vault; the credential helper and subcommands must RPC it at /auth/token or do their own heavy unlock — hence the brittle lockfile/health-probe/zombie machinery.
• Password handling is ad-hoc and repeated (GITD_PASSWORD / TTY prompts in several files, no PasswordProvider, no keychain) → "asked for the vault password repeatedly"; hangs in CI.
• The wallet/dapp vision in UX_MVP_PLAN.md is unbuilt — writes require unlocking a local HD vault, which is what forces the daemon coupling.

Approach

Make @enbox/auth's persisted AuthSession the single source of truth (restoreSession() on every invocation — no live process needed to "stay logged in"), and prefer a wallet-delegated session where gitd holds a delegate did:jwk + grants so git push signing needs no vault, no password, and no daemon. The daemon becomes an optional warm cache, never on the critical path.

Phases (one PR each)

1. Durable secret store + session core (gitd) — keychain/encrypted-file secret + single password-resolution path + restoreSession-friendly caching. ← this PR
2. Generalize the wallet's CLI-connect mechanism (web-wallet) — protocol-agnostic, no gitd-specific route.
3. CLI connect handler + wallet-first gitd auth login (gitd).
4. Delegation-aware push (git-server + credential helper) — verify owner→delegate grant; sign with delegate key; drop the hard /auth/token daemon dependency.
5. Daemon demotion + cleanup (gitd) — daemon optional/warm, never auth-critical.
6. Local-vault parity, public-reader, doctor (gitd).

Work stacks on #185 (UX MVP CLI flows), which contains the session/helper subsystem being redesigned.