fix(fuse,core,cli,gui): say when the keyring refuses the refreshed sign-in

A rotation the keyring refused was retried and kept in the kernel
keyring, but only the log said so, and a reboot before the keyring took
it still signed the user out.

`Response::Status` carries `tokens_unsaved` while one waits. The tray
says "Sign-in not saved — unlock your keyring" and needs attention, the
app's status says the same, `pdfs status` prints a Keyring line and
`pdfs diagnose` warns. New strings are translated in every catalog
(B61).

crates/pdfs-cli/src/main.rs

@@ -2025,6 +2025,7 @@ fn cmd_status() -> Result<()> {
             paused,
             paused_until,
             session_expired,
+            tokens_unsaved,
             ..
         }) => {
             let state = match (online, paused) {
@@ -2061,6 +2062,11 @@ fn cmd_status() -> Result<()> {
                     failing_error.as_deref().unwrap_or("no error recorded"),
                 );
             }
+            if tokens_unsaved {
+                println!(
+                    "Keyring    refuses the refreshed sign-in; unlock it, or a reboot needs `pdfs login`"
+                );
+            }
         }
         Ok(other) => println!("Mount: unexpected response {other:?}"),
         Err(_) => println!("Mount: not running."),
@@ -3435,6 +3441,7 @@ fn cmd_diagnose() -> Result<()> {
             mountpoint,
             online,
             session_expired,
+            tokens_unsaved,
             pending_uploads,
             pending_changes,
             ..
@@ -3456,6 +3463,15 @@ fn cmd_diagnose() -> Result<()> {
                     |kind| format!("{mountpoint} ({kind})"),
                 ),
             );
+            // The keyring check above read the blob, which still holds the
+            // tokens the daemon could not replace.
+            if tokens_unsaved {
+                report.finding(
+                    DiagnoseLevel::Warn,
+                    "  session tokens",
+                    "the keyring refuses the refreshed ones; unlock it, or a reboot needs `pdfs login`",
+                );
+            }
             // A refused session reads as offline too, but no connection will
             // bring it back, and the keyring check above cannot tell.
             if session_expired {