feat: keep GitHub tokens in the OS secret store [minor]

.gitignore

@@ -203,6 +203,11 @@ PublishScripts/
 **/[Pp]ackages/*
 # except build/, which is used as an MSBuild target.
 !**/[Pp]ackages/build/
+# and except a Unity project's Packages/, which is source: Unity's package manifest and its
+# resolved lock file are both meant to be committed, and a NuGet restore folder never contains
+# a file by either name.
+!**/[Pp]ackages/manifest.json
+!**/[Pp]ackages/packages-lock.json
 # Uncomment if necessary however generally it will be regenerated when needed
 #!**/[Pp]ackages/repositories.config
 # NuGet v3's project.json files produces more ignorable files
@@ -651,3 +656,16 @@ Temporary Items
 
 # ImGui.ini files
 imgui.ini
+
+# Game engine projects
+#
+# Godot: the import cache, and the mono/temp bin+obj a C# build writes.
+.godot/
+
+# Unity: .meta files are source, not the Visual Studio C++ build artifact that the `*.meta` rule
+# further up targets. Unity generates one per asset and it carries the GUID that scenes, prefabs
+# and serialized references point at, so ignoring them gives every clone fresh GUIDs and silently
+# breaks those references - including for a plug-in whose .dll is itself a build output. This
+# negation has to come after that rule to win, and is scoped to the asset tree so the Visual
+# Studio artifact stays ignored everywhere else.
+!**/[Aa]ssets/**/*.meta

CLAUDE.md

@@ -41,7 +41,13 @@ dotnet test --configuration Release
 
 **[ProjectDirectorOptions.cs](ProjectDirector/ProjectDirectorOptions.cs)** - Application state
 - Extends `AppData<T>` from ktsu.AppDataStorage for automatic JSON persistence
-- Stores: dev directory path, GitHub credentials, repo cache, UI state (divider positions, panel states)
+- Stores: dev directory path, which GitHub owners are configured, repo cache, UI state (divider
+  positions, panel states)
+- **Not** GitHub tokens. Those live in the OS secret store via
+  [TokenStorage.cs](ProjectDirector/TokenStorage.cs), because this file sits next to UI preferences
+  and is rewritten on every debounced save
+- `LegacyGitHubToken` and `LegacyGitHubOwners` keep the old JSON names purely for the one-time
+  migration run at startup: tokens are written to the secret store first, then emptied here
 - Semantic string types for type-safe paths and identifiers
 
 **[GitRepository.cs](ProjectDirector/GitRepository.cs)** - Repository abstraction
@@ -62,7 +68,7 @@ dotnet test --configuration Release
 
 Git LFS is a pair of filters plus a set of hooks, and all of them belong to the git command. A library that reads and writes the object database directly bypasses them: a commit stores raw bytes where a pointer belongs, and a clone or checkout lands the pointer text on disk where the file belongs. This application clones, fetches and pulls, so it is the checkout side that matters here. `ProjectDirector.Test` pins both halves down.
 
-Authentication follows from the same decision. There are no credentials in this code, because git uses the platform credential helper, which is also what makes SSH remotes work.
+Authentication follows from the same decision. There are no credentials in this code for git operations, because git uses the platform credential helper, which is also what makes SSH remotes work. The GitHub API tokens the app does hold follow the same principle: `TokenStorage` keeps them in the platform secret store (Windows Credential Manager, macOS Keychain, libsecret on Linux), derives a persona per token from a versioned namespace plus the login or owner name, and never falls back to a plain file. With no usable store, tokens read as empty and the reason reaches the log once — a throw out of a token read would take down the render loop.
 
 ### Key Dependencies
 

Directory.Packages.props

@@ -7,6 +7,7 @@
     <PackageVersion Include="Hexa.NET.ImGui" Version="2.2.9" />
     <PackageVersion Include="ImGui.NET" Version="1.91.6.1" />
     <PackageVersion Include="ktsu.AppDataStorage" Version="1.17.6" />
+    <PackageVersion Include="ktsu.CredentialCache" Version="1.3.49" />
     <PackageVersion Include="ktsu.Extensions" Version="1.6.16" />
     <PackageVersion Include="ktsu.ImGui.App" Version="3.38.8" />
     <PackageVersion Include="ktsu.ImGui.Popups" Version="3.38.8" />