fix(fuse,core,cli,gui): say when the keyring refuses the refreshed sign-in

A rotation the keyring refused was retried and kept in the kernel
keyring, but only the log said so, and a reboot before the keyring took
it still signed the user out.

`Response::Status` carries `tokens_unsaved` while one waits. The tray
says "Sign-in not saved — unlock your keyring" and needs attention, the
app's status says the same, `pdfs status` prints a Keyring line and
`pdfs diagnose` warns. New strings are translated in every catalog
(B61).

crates/pdfs-core/src/auth.rs

@@ -750,6 +750,16 @@ pub fn stored_session_is_newer() -> bool {
     }
 }
 
+/// Whether a session in this process holds refreshed tokens the keyring has
+/// not taken yet. They are retried and kept in the kernel keyring meanwhile,
+/// which a reboot clears, so the user is asked to unlock the keyring (B61).
+pub fn tokens_unsaved() -> bool {
+    TOKEN_SINKS
+        .lock()
+        .values()
+        .any(|sink| sink.state.lock().unsaved.is_some())
+}
+
 /// Where each live session in this process writes its rotated tokens, by
 /// session id, for [`persist`] to find.
 static TOKEN_SINKS: parking_lot::Mutex<BTreeMap<String, Arc<TokenSink>>> =