feat: macOS Keychain credential caching for CachedResolver

[markballew]

Problem

On native macOS (not in a devcontainer), the Linux kernel keyring (keyctl) is unavailable. We need an equivalent caching mechanism for macOS so that repeated CLI invocations don't trigger Touch ID on every call.

Proposed Solution

Add macOS Keychain support to the CachedResolver (see #73) as the macOS-specific backend.

Why macOS Keychain

• Encrypted at rest — credentials are stored in the encrypted Keychain database
• Per-user access control — only the owning user can read the entry
• TTL via kSecAttrAccessible / custom metadata — store an expiry timestamp in the Keychain item, check on read
• No daemon — Keychain is a system service, always available
• Native to macOS — available on all macOS versions

Implementation Options

Option A: security CLI

# Store
security add-generic-password -a "mcp" -s "mcp:netbox-token" -w "the-secret" -U

# Read
security find-generic-password -a "mcp" -s "mcp:netbox-token" -w

# Delete (for expiry/invalidation)
security delete-generic-password -a "mcp" -s "mcp:netbox-token"

TTL enforcement: store a second Keychain item mcp:netbox-token:expires with the expiry timestamp. On read, check if expired → delete + re-resolve.

Option B: Python keyring library

import keyring
keyring.set_password("mcp", "netbox-token", secret)
value = keyring.get_password("mcp", "netbox-token")

Pro: cross-platform API. Con: adds a pip dependency.

Research needed

• Does macOS Keychain support native TTL/expiry on items, or do we need to manage expiry ourselves?
• Does security CLI work in a headless context (e.g., SSH session to a Mac)?
• Does this work when the Mac is the devcontainer host (i.e., called from inside the container via op-forward)?

Relationship to #73

• feat: CachedResolver wrapper using Linux kernel keyring (keyctl) #73 implements CachedResolver with keyctl for Linux
• This issue adds macOS Keychain as the backend when keyctl is unavailable
• CachedResolver auto-detects platform: Linux → keyctl, macOS → Keychain

Non-goals

• Disk-based file caching (not secure — plaintext on disk)
• Daemon-based caching
• Windows support