Ghost FTP 0.95.49 — credential security hardening (UNRELEASED Preview)

This is not a GitHub release. v0.95.48 is published and immutable. The original PR #214 has already merged, so these further branch commits are not included in PR #214 and are not in main. A new PR is intentionally not created.

Windows and Linux

• Preserve exact keyring::Entry(service,account) Windows Credential Manager identifiers.
• Linux: use a user-session Secret Service implementation (GNOME Keyring or KWallet with D-Bus Secret Service compatibility) via libsecret's secret-tool, available from the libsecret-tools package. New writes fail closed if the persistent store is unavailable, never silently using kernel-only storage.
• When reading Linux accounts, first check Secret Service, then fall back to the prior keyutils entry. When migrating, write the old secret over a private stdin pipe, read back and verify it before relying on the new value. The old keyutils secret is not removed during migration. Remove both stores on explicit verified credential deletion.
• Credentials, OAuth tokens and encrypted backup/restore now share a single OS vault API. A locked/unavailable vault is an error, not absent credentials, for frontend status.
• Profile and API-key manifest updates are ordered to avoid orphaned secrets: record before write; delete from vault and verify before dropping the SQLite manifest. A failed operation keeps a conservative manifest record for recovery.
• Backup container format version 1, Argon2id m=64MiB/t=3/p=1, AES-256-GCM, profile schema and user data are preserved. Staging conflicts are rejected, and a failed staging attempts credential rollback.
• Added a fault-injected delete-before-manifest regression test. Existing locked keyring and fake backup vault tests continue.

Required acceptance before any release

1. On clean Windows installations, test actual Credential Manager with a normal and restricted Windows account: write/read/delete, locked/unavailable vault, concurrent update, restart, app uninstallation and explicit retention behavior.
2. On GNOME Keyring and KDE KWallet Secret Service, install libsecret-tools, configure a D-Bus user session, test a migrated pre-upgrade keyutils secret before reboot, migration verified before old removal, fresh writes, reboot/login, locked vault, no D-Bus, denied writes, offline access and concurrent processes. Verify no sensitive data in ps, logs or system crash dumps.
3. Verify the bundled Linux DEB/RPM/AppImage dependency on secret-tool: package installation and actual supported user session are required. Current packaging does not prove the tool is installed on every target machine.
4. Backup and restore corrupted/wrong-password containers; fault-inject SQLite disk-full, staged-file permission failure, interrupted WAL/SHM promotions, OS-vault denied writes and rollback failure, including real target-device restart.
5. Confirm all exact-head CI workflows and real cloud credentials under disposable provider accounts. Static and mock tests cannot certify hardware vault behavior, process-kill recovery or vendor acceptance.

Known risk / limits

• Linux Secret Service uses a synchronous user-session command helper, and must be measured for latency and tested in desktop packaging. Absence of secret-tool is a blocking setup error for new credentials.
• A retained legacy kernel keyutils copy may remain until a verified explicit deletion; it should be included in security review and never be considered persistent after reboot.
• A multi-file backup apply/restore is not yet proven power-loss atomic across DB, WAL/SHM, configs and OS keychains. Do not claim otherwise.
• The UI may need an explicit "Repair credential manifest" workflow so orphaned entries left by denied vault access can be safely audited and reconciled after unlocking the vault.