Motivation

• Provide native OS secret backends so AuthTranslator can read secrets from macOS Keychain, Linux Secret Service, and Windows Credential Manager.
• Support common platform-specific workflows by exposing keychain:, secretservice:, and wincred: URI schemes.

Description

• Add a macOS Keychain plugin (app/secrets/plugins/keychain) that invokes the security CLI and parses ids in service or service#account form with tests and an injectable execSecurityCommand wrapper.
• Add a Linux Secret Service plugin (app/secrets/plugins/secretservice) that invokes secret-tool and parses comma-separated key=value attributes with tests and an injectable execSecretTool wrapper.
• Add a Windows Credential Manager plugin (app/secrets/plugins/wincred) implementing platform-specific loading via CredReadW on Windows and a stub on non-Windows, plus decoding helpers for raw, utf8, and utf16le blobs and comprehensive unit tests.
• Register the new plugins in app/secrets/plugins/plugins.go and update docs/secret-backends.md with usage examples and environment notes.

Testing

• Ran unit tests for the plugins package with go test ./app/secrets/plugins and all tests passed.
• Ran the full test suite with go test ./... and there were no test failures.

Codex Task