MacKeychainKeyStore
macOS implementation of IAiKeyStore. Stores each key in the user's login keychain via the
/usr/bin/security command-line tool, under a per-provider service name. The key is encrypted at rest by the OS and gated by the user's login. Caveat: during Set/Delete the API key briefly appears as an argument in process listings. The keychain entry itself is properly encrypted. A future improvement would be P/Invoke to Security.framework's SecKeychain APIs directly, which avoids the argv exposure.