Release 0.0.6: token-gated updates (M13) with encrypted storage

- updates gated to Gitea account holders via a Personal Access Token (D18
  revised: anonymous HTTP -> authenticated HTTP, since the instance requires
  sign-in for all anonymous access)
- token stored encrypted in the OS keyring (secret-tool) when available, with
  a 0600-file fallback; $RIGDOCTOR_TOKEN override; auto-migrate file->keyring
  once libsecret-tools is installed
- core/updates: token-aware fetch_latest + update_state (no-token/auth/network/
  up-to-date/available)
- CLI: rigdoctor login / logout / update [--check]
- GUI: Setup "Update access" panel (token field, get-a-token, backend status);
  sidebar update states; libsecret-tools added to the installer catalog
- token storage tests (file fallback + env override, keyring mocked)
- version 0.0.6, CHANGELOG, docs

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_token.py

@@ -0,0 +1,36 @@
+"""Tests for update-token storage (file fallback + env override), keyring mocked out."""
+
+import os
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+from rigdoctor import config
+
+
+class TokenStorageTests(unittest.TestCase):
+    def test_file_fallback_roundtrip(self):
+        with tempfile.TemporaryDirectory() as d:
+            token_file = Path(d) / "token"
+            with mock.patch.object(config, "_secret_tool", return_value=None), \
+                 mock.patch.object(config, "TOKEN_FILE", token_file), \
+                 mock.patch.dict(os.environ, {}, clear=True):
+                self.assertIsNone(config.load_token())
+                config.save_token("abc123")
+                self.assertEqual(config.load_token(), "abc123")
+                self.assertEqual(config.token_backend(), "file")
+                self.assertEqual(token_file.stat().st_mode & 0o777, 0o600)
+                config.clear_token()
+                self.assertIsNone(config.load_token())
+                self.assertEqual(config.token_backend(), "none")
+
+    def test_env_override_wins(self):
+        with mock.patch.object(config, "_secret_tool", return_value=None), \
+             mock.patch.dict(os.environ, {"RIGDOCTOR_TOKEN": "envtok"}, clear=True):
+            self.assertEqual(config.load_token(), "envtok")
+            self.assertEqual(config.token_backend(), "env")
+
+
+if __name__ == "__main__":
+    unittest.main()