docs(adr): ADR 0001 addendum — Pasqal password to OS keychain (#194)

[kateebonner]

Records the evidence-forced amendment to ADR 0001 for the Pasqal Cloud connection. Design context in #194.

Why

Jack's live-API session (pasqal-auth-bundle, 2026-07-21; independently re-probed) proved every no-password path for a Pasqal user account is dead:

• auth-code/PKCE: no localhost callback on Pasqal's client, and we don't own the tenant
• device-code grant: disabled on the client
• refresh tokens: issued but 403'd by the API (gates on the gty claim; identical aud/scope/permissions to a working password token)
• access tokens live ~24h

So a valid token cannot exist beyond ~24h without the password present somewhere. The ADR's named fallback (session-only re-prompt) means typing the password ~daily; product decision (Kate) is that's unacceptable for the panel, adopting Jack's keychain interim.

What the addendum records

• For pasqal-cloud only: username+password → OS keychain (@napi-rs/keyring, Jack's mechanism), silent ROPC re-mint on expiry; token stays token-only in pasqal.json. Session-memory fallback where the native binding can't load (never a plaintext file). Disconnect wipes.
• Revised risk position (same-user-readable keychain, accepted knowingly) and the exit condition: a Pasqal service account (client_credentials) retires the password entirely — request in flight with Baptiste Peyras.
• Scoped to pasqal-cloud; not precedent for any other connection.

Verification

The workaround this documents is implemented in the opencode fork (harmoniqs/opencode kate/connections-path-scaffold) and verified live against real Pasqal — connect, silent re-mint, reject, and disconnect all exercised on a real machine, with the native keyring proven to survive bun build --compile.

🤖 Generated with Claude Code