fix(security): use keyring to store tokens upon login

[rawnly]

No description provided.

[Copilot]

Pull Request Overview

This PR enhances security by migrating token storage from local config (using Viper) to the OS keyring.

• Introduces a new tokens package leveraging go-keyring to set, get, and clear tokens.
• Updates API utilities, commands, and main.go to use keyring-based token operations instead of Viper.
• Removes sensitive debug logging of client credentials in the Me() method.

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
unsplash/util.go	Switched from viper.GetString to tokens.GetAccessToken and simplified debug logs.
unsplash/tokens/tokens.go	New package to store, retrieve, and clear access/refresh tokens via keyring.
unsplash/auth.go	Removed debug logging of client_id and client_secret.
main.go	Replaced Viper-based token retrieval with keyring-based tokens.Get*.
cmd/auth/whoami.go	Updated to retrieve the access token from keyring.
cmd/auth/logout.go	Added tokens.Clear() before clearing Viper entries.
cmd/auth/login.go	Switched to tokens.Set* for storing tokens and fixed authenticationURL naming.
go.mod	Added go-keyring and updated indirect dependencies for keyring support.

[Copilot]

After clearing tokens in the keyring, the Viper config is set but not persisted; add viper.WriteConfig() to ensure the config file no longer retains auth tokens.