secrets: org.freedesktop.secrets daemon rooted in the machine SeedId

souveraine-secrets (feature 'secrets', own bin target) backs libsecret
clients — Chatty/libcmatrix and our keyring-core store — without
gnome-keyring or KWallet. Implements the dh-ietf1024-sha256-aes128-cbc-pkcs7
session transport (zbus/hkdf/aes-cbc, MODP-1024 via num-bigint) plus
collection/item/session objects and the store. SeedId::load() is the strict
no-generate counterpart to load_or_generate: the daemon treats identity as a
precondition and fails loudly if none exists.

Cargo.lock

@@ -9062,14 +9062,17 @@ dependencies = [
 name = "souveraine"
 version = "1.0.0"
 dependencies = [
+ "aes",
  "anyhow",
  "arboard",
  "async-trait",
  "axis2d",
  "axum",
  "base64 0.22.1",
+ "cbc",
  "chord_macro 0.1.0",
  "chrono",
+ "cipher",
  "clap 4.6.1",
  "clap_complete",
  "colored",
@@ -9086,12 +9089,15 @@ dependencies = [
  "git2",
  "glob",
  "hex",
+ "hkdf",
  "hound",
  "image",
  "keyring",
  "keyring-core",
  "matrix-sdk",
  "notify",
+ "num-bigint",
+ "num-traits",
  "once_cell",
  "pulldown-cmark",
  "rand 0.8.6",
@@ -9130,6 +9136,8 @@ dependencies = [
  "unicode-width 0.1.14",
  "uuid",
  "walkdir",
+ "zbus",
+ "zvariant",
 ]
 
 [[package]]
@@ -10403,6 +10411,7 @@ dependencies = [
  "signal-hook-registry",
  "socket2",
  "tokio-macros",
+ "tracing",
  "windows-sys 0.61.2",
 ]
 
@@ -13206,6 +13215,7 @@ dependencies = [
  "rustix 1.1.4",
  "serde",
  "serde_repr",
+ "tokio",
  "tracing",
  "uds_windows",
  "uuid",