feat: default macOS credentials to file backend

[tangyu]

Summary

Default macOS credential storage to the local encrypted file backend so local automation, headless sessions, and AI agent workflows are not interrupted by Keychain prompts. Keep explicit backend selection via LARKSUITE_CLI_KEYCHAIN_BACKEND for file, auto, and keychain.

Changes

• Add macOS LARKSUITE_CLI_KEYCHAIN_BACKEND=file|auto|keychain backend selection.
• Make file the default macOS backend for AppSecret and UAT storage.
• Preserve auto for the previous Keychain-first behavior with file fallback.
• Document the macOS credential backend in English and Chinese READMEs.

Test Plan

• Unit tests pass: go test ./internal/keychain ./internal/credential ./internal/auth
• Manual local verification confirms the lark-cli --version command works as expected after make install PREFIX=/opt/homebrew

Related Issues

• Related to [Feature] Implement Encrypted File Fallback for Keychain Storage #147
• Related to feat: add darwin file master key fallback for keychain writes #285
• Related to fix(mail): avoid real keychain access in mail scope tests #212

Notes

This PR intentionally changes the macOS default from Keychain/auto behavior to file-backed storage. Existing Keychain-backed installs may need migration handling or an explicit compatibility decision before the PR is marked ready.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Tom seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8aaa02d9-b8e2-4c05-a3b1-dadf45a3dda9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}