Encrypt the SecretService D-Bus session (dh-ietf-1024-sha256)

Summary

The Linux SecretService provider opens its D-Bus session with "plain" negotiation, so secrets traverse the user's session bus unencrypted. A local process able to snoop the session bus can read them in transit.

Where

keyring_secretservice.go:59:

err := s.srv.Call(method, 0, "plain", dbus.MakeVariant("")).Store(&disregard, &sessionPath)

Already documented as a known limitation in the README "Security considerations" section (README.md:58-60).

Proposed change

Implement the SecretService dh-ietf-1024-sha256 session algorithm instead of "plain":

• client sends its DH public key in OpenSession,
• derive the shared secret from the returned server key,
• HKDF to an AES key,
• send/receive the secret as the encrypted (parameters, value) pair.

This is roughly ~150 lines plus test vectors.

Why this is deferred, not done now

• Correctness risk: a subtle KDF/padding bug silently corrupts stored secrets. It needs interop testing against gnome-keyring and KeePassXC before it can ship.
• Bounded threat model: the attacker must already be able to read the user's D-Bus session bus — a fairly privileged local position, though not strictly equivalent to reading process memory under every session policy. The protection is real but bounded.
• Orthogonal: it's independent of every other change and can land on its own schedule.

Acceptance criteria

• OpenSession negotiates dh-ietf-1024-sha256; secrets are encrypted on the bus.
• Round-trips interoperate with gnome-keyring and KeePassXC.
• "plain" fallback only if the daemon rejects DH (documented).
• Update the README security note once implemented.

Tracking issue for Item 2 of the internal backlog design; deferred by decision, not oversight.

Start at keyring_secretservice.go:59 and review the README security considerations at lines 58-60. Then study the SecretService session algorithm requirements, test vectors, and interoperability with gnome-keyring and KeePassXC. Done means DH negotiation, encrypted secret round-trips, documented fallback behavior, and an updated README note.