Fix #17: detect locked keychain and preserve credentials on access failure

- Export KeychainAccessError from session.ts; thrown when getPassword() fails (platform error like locked keychain), not when an entry is missing (undefined) - resumeSession() now rethrows KeychainAccessError without clearing metadata, so temporarily locked keychains no longer wipe stored credentials - Add ensureAuthenticated(client) to auth-helpers.ts: on KeychainAccessError, attempts to unlock the keychain via `security unlock-keychain` (macOS only), retries once, then falls back to a clear error message with manual instructions - Replace 7 repeated inline auth-check blocks in issue.ts with ensureAuthenticated() - Add/update tests for KeychainAccessError propagation and ensureAuthenticated behavior Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>