feat: default macOS credentials to file backend

[tangyu]

Summary

Default macOS credential storage to the local encrypted file backend so local automation, headless sessions, and AI agent workflows are not interrupted by Keychain prompts. Keep explicit backend selection via LARKSUITE_CLI_KEYCHAIN_BACKEND for file, auto, and keychain.

Changes

• Add macOS LARKSUITE_CLI_KEYCHAIN_BACKEND=file|auto|keychain backend selection.
• Make file the default macOS backend for AppSecret and UAT storage.
• Preserve auto for the previous Keychain-first behavior with file fallback.
• Document the macOS credential backend in English and Chinese READMEs.

Test Plan

• Unit tests pass: go test ./internal/keychain ./internal/credential ./internal/auth
• Manual local verification confirms the lark-cli --version command works as expected after make install PREFIX=/opt/homebrew

Related Issues

• Related to [Feature] Implement Encrypted File Fallback for Keychain Storage #147
• Related to feat: add darwin file master key fallback for keychain writes #285
• Related to fix(mail): avoid real keychain access in mail scope tests #212

Notes

This PR intentionally changes the macOS default from Keychain/auto behavior to file-backed storage. Existing Keychain-backed installs may need migration handling or an explicit compatibility decision before the PR is marked ready.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Tom seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7ffeff79-4221-4199-ae85-7c36e461e6fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[albertnusouo]

@tangyu
The goal here aligns with what we shipped in #1085 (merged): unblocking automation / headless / agent contexts on macOS. The designs trade off differently:

This PR flips the macOS default to file-backed storage for everyone, plus adds a LARKSUITE_CLI_KEYCHAIN_BACKEND knob.
#1085 keeps the Keychain default; users who hit the automation pain point run lark-cli config keychain-downgrade once interactively, after which file fallback is durable and per-user.
The opt-in approach sidesteps the migration concern you flagged in the PR notes ("Existing Keychain-backed installs may need migration handling…"). It also preserves the stronger per-app Keychain ACL for users who don't need the escape hatch, while giving those who do a clean, discoverable command.

If an env-var backend selector is still useful on top of #1085 — e.g. for CI provisioning where the interactive prerequisite is awkward — that's worth a separate discussion. For the core use case here, #1085 should cover it.