fix: handle missing keyring backend in CI

The keyring package imports successfully on headless Linux but uses a
fail.Keyring backend that raises NoKeyringError on any operation. Detect
this case in _get_keyring() and fall back to the file-based token store.

tests/test_config.py

@@ -64,7 +64,7 @@ def test_settings_load_ignores_unknown_keys(config_module, tmp_path):
 
 def test_token_fallback_roundtrip(config_module, monkeypatch):
     """Force the non-keyring fallback path and verify round-trip."""
-    monkeypatch.setattr(config_module, "_keyring_available", lambda: False)
+    monkeypatch.setattr(config_module, "_get_keyring", lambda: None)
 
     assert config_module.load_token() is None
 
@@ -82,7 +82,7 @@ def test_token_fallback_file_permissions(config_module, monkeypatch):
     import os
     import stat
 
-    monkeypatch.setattr(config_module, "_keyring_available", lambda: False)
+    monkeypatch.setattr(config_module, "_get_keyring", lambda: None)
     config_module.save_token("sl.perm-test")
 
     mode = os.stat(config_module.TOKEN_FALLBACK_FILE).st_mode
@@ -96,8 +96,8 @@ def test_token_keyring_roundtrip(config_module):
     """If keyring is installed, verify we actually use it."""
     pytest.importorskip("keyring")
 
-    if not config_module._keyring_available():
-        pytest.skip("keyring not importable")
+    if config_module._get_keyring() is None:
+        pytest.skip("keyring not usable")
 
     import keyring
     # Use the in-memory fallback backend to avoid touching real Keychain.