refactor: turn_end_callback + desktop pet + keychain

- agent_loop: next_prompt_patcher -> turn_end_callback with full context
- agent_loop: exit logic unified (break + callback), no early return
- ga: summary extraction moved from tool_after_callback to turn_end_callback
- ga: _turn_end_hooks support for external subscribers
- stapp: desktop pet button with HTTP status push
- keychain: XOR-masked secret storage with SecretStr
- gitignore: whitelist keychain.py

.gitignore

@@ -73,6 +73,9 @@ memory/L4_raw_sessions/*
 # ADB UI tool
 !memory/adb_ui.py
 
+# Keychain
+!memory/keychain.py
+
 # Visual Studio
 .vs/
 restore_commit.txt