fix(secret): treat ErrNotFound on keyring delete as already deleted (#1758)

## Bug

`KeyringProvider.Delete` treats every error from `keyring.Delete` as a
keyring failure, including `keyring.ErrNotFound`. When the entry was
already removed outside mcpproxy (Keychain Access, `security
delete-generic-password`, Seahorse, Credential Manager), it returns
before `removeFromRegistry`, so the name stays in the registry and
`List` keeps showing it. Every later delete hits the same error.

It also calls `markUnavailable()`, so for the rest of the process every
keyring `Store`/`Delete` short-circuits with `ErrKeyringUnavailable`,
even though the keyring just answered fine.

## Trigger

1. Store a secret `foo` through the UI or `mcpproxy secrets set`.
2. Delete the `mcpproxy`/`foo` item in Keychain Access.
3. Call `DELETE /api/v1/secrets/foo`. It returns `500 failed to delete
secret foo from keyring: secret not found in keyring` on every retry,
`foo` stays listed, and further secret writes fail as "keyring
unavailable".

## Fix

Treat `keyring.ErrNotFound` from the delete as success: the keyring
answered and the entry is already gone. So the provider is not marked
unavailable and execution continues to `removeFromRegistry`. Other
errors behave as before. `IsAvailable` already uses the same convention,
where `ErrNotFound` means "available, no secret".

## Test

`TestKeyringProvider_Delete_AlreadyGoneCleansRegistry` uses the existing
`withKeyringMocks` seam, with `Delete` returning `ErrNotFound`. It
asserts that `Delete` returns nil, the registry drops `foo`, `List`
returns only `bar`, and the provider is not marked unavailable.

## Commands run

- `CGO_ENABLED=0 go test -count=1 ./internal/secret`: ok
- With the fix reverted (`git stash` of `keyring_provider.go`), `-run
AlreadyGone` fails with `Delete of an already-removed secret: failed to
delete secret foo from keyring: secret not found in keyring`.
- `gofmt -l` on the edited files: no output

Author: rudycelekli

internal/secret/keyring_delete_notfound_test.go

@@ -0,0 +1,46 @@
+package secret
+
+import (
+	"context"
+	"testing"
+
+	"github.com/zalando/go-keyring"
+)
+
+// A secret removed outside mcpproxy (Keychain Access, `security
+// delete-generic-password`) makes keyring.Delete return ErrNotFound. That must
+// still clean the registry and must not mark the whole keyring unavailable.
+func TestKeyringProvider_Delete_AlreadyGoneCleansRegistry(t *testing.T) {
+	clearHeadlessEnv(t)
+	registry := "foo\nbar"
+	withKeyringMocks(t,
+		func(_, user string) (string, error) {
+			if user == RegistryKey {
+				return registry, nil
+			}
+			return "", keyring.ErrNotFound
+		},
+		func(_, user, password string) error {
+			if user == RegistryKey {
+				registry = password
+			}
+			return nil
+		},
+		func(_, _ string) error { return keyring.ErrNotFound },
+	)
+
+	p := NewKeyringProvider()
+	if err := p.Delete(context.Background(), Ref{Type: SecretTypeKeyring, Name: "foo"}); err != nil {
+		t.Fatalf("Delete of an already-removed secret: %v", err)
+	}
+	if registry != "bar" {
+		t.Errorf("registry = %q, want %q", registry, "bar")
+	}
+	if p.isKnownUnavailable() {
+		t.Error("keyring marked unavailable after ErrNotFound on delete")
+	}
+	refs, err := p.List(context.Background())
+	if err != nil || len(refs) != 1 || refs[0].Name != "bar" {
+		t.Errorf("List = %v, %v; want only bar", refs, err)
+	}
+}

internal/secret/keyring_provider.go

@@ -280,7 +280,9 @@ func (p *KeyringProvider) Delete(_ context.Context, ref Ref) error {
 	err := runWithTimeout(func() error {
 		return keyringDelFn(p.serviceName, ref.Name)
 	})
-	if err != nil {
+	// ErrNotFound means the keyring answered and the entry is already gone
+	// (e.g. removed in Keychain Access); the registry still needs cleaning.
+	if err != nil && !errors.Is(err, keyring.ErrNotFound) {
 		p.markUnavailable()
 		return fmt.Errorf("failed to delete secret %s from keyring: %w", ref.Name, err)
 	}