Building a Jira Time Tracker with Tauri: How I Stored API Tokens Securely

I've been building a small menu-bar app for tracking time on Jira issues. Mostly it's boring CRUD: a timer, a list of issues, push worklogs back to Jira. Except for one thing I had to figure out on day one. The user logs in with a Jira API token, and that token has to live somewhere on their machine. Where, exactly? Every Tauri tutorial skips this part. Below is what I tried, what broke, and what I shipped. My first attempt (don't do this) I already had a local SQLite database in the app for cac