fix: support secure WSL credential storage

[SilkageNet]

Summary

• detect WSL and protect the vault key with Windows current-user DPAPI instead of requiring a Linux desktop Secret Service
• keep only DPAPI ciphertext in HKCU and send secrets to the static PowerShell bridge over stdin, never argv
• retain Secret Service as a compatibility fallback for existing WSL vaults
• add Linux bridge tests, a real Windows PowerShell/DPAPI round-trip test, and WSL setup documentation

Validation

• go test -race ./...
• go vet ./...
• golangci-lint on darwin, linux, and windows targets
• Linux-specific test binary executed in an Alpine container
• six release target cross-builds
• gitleaks dir . --redact --no-banner

Windows CI is expected to execute the DPAPI set/get/delete integration test against powershell.exe.