fix(fuse,core,cli,gui): say when the keyring refuses the refreshed sign-in

A rotation the keyring refused was retried and kept in the kernel
keyring, but only the log said so, and a reboot before the keyring took
it still signed the user out.

`Response::Status` carries `tokens_unsaved` while one waits. The tray
says "Sign-in not saved — unlock your keyring" and needs attention, the
app's status says the same, `pdfs status` prints a Keyring line and
`pdfs diagnose` warns. New strings are translated in every catalog
(B61).

crates/pdfs-core/src/control.rs

@@ -1964,6 +1964,11 @@ pub enum Response {
         /// connection brings it back: only signing in again does.
         #[serde(default)]
         session_expired: bool,
+        /// True while the keyring refuses the session's refreshed tokens. The
+        /// daemon keeps retrying; until it succeeds, a reboot signs the user
+        /// out.
+        #[serde(default)]
+        tokens_unsaved: bool,
     },
     /// A human-readable success message.
     Ok { message: String },