migrate secrets management from KWallet to gnome-keyring + Bitwarden

Architecture: Bitwarden (central vault) → rbw CLI → gnome-keyring
(local cache via org.freedesktop.secrets D-Bus). All apps (himalaya,
git, ssh-agent, JetBrains IDEs, browsers) now read secrets via
libsecret/secret-tool through gnome-keyring.

Changes:
- Install gnome-keyring + rbw, enable as systemd user service
- Configure rbw → bitwarden.jantec.xyz (ironmikechw+bitwarden@gmail.com)
- Migrate 45 meaningful entries from KWallet → BW + GK
- Switch git credential.helper from store to libsecret
- Document: one-pager, ADR, migration checklist, NEXT_STEPS update
- Skill: devops/secrets-migration for reuse

Post-reboot manual: himalaya IMAP passwords (4 accounts, were not in
KWallet) and GitHub CLI token re-auth.

See docs/product/passwords.md for the full guide.

AGENTS.md

@@ -25,6 +25,7 @@ This repository manages the infrastructure, configuration, and maintenance for M
 - **NEVER** commit raw secrets to the repository.
 - **ALWAYS** run Ansible with `--check` before applying changes.
 - **NEVER** modify system configuration directly if it can be managed via Ansible.
+- **Secrets Management**: All secrets stored in Bitwarden (`bitwarden.jantec.xyz`) and cached locally in `gnome-keyring` (D-Bus secrets service). See `docs/product/passwords.md` for details.
 
 ## Rules Hierarchy
 - Global rules: `Rules/`