Pin browser password store to gnome-libsecret (#6065)

Chromium-based browsers auto-detect their os_crypt backend at launch. On
Hyprland the xdg-desktop-portal Secret backend has no provider, so the
autodetect can fall back to the 'basic' (v10) store, making previously
v11-encrypted cookies and saved passwords undecryptable — the user is
silently logged out of everything. Pin gnome-libsecret (the stock
omarchy keyring) so the backend is deterministic, matching what we
already do for VSCode.

Migration covers chromium, brave, chrome, and edge flags confs for
existing installs.

Co-authored-by: Niklas Tscheppe <ntscheppe@drgt.net>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

config/chromium-flags.conf

@@ -1,4 +1,5 @@
 --ozone-platform=wayland
 --ozone-platform-hint=wayland
+--password-store=gnome-libsecret
 --enable-features=TouchpadOverscrollHistoryNavigation
 --load-extension=/usr/share/omarchy/default/chromium/extensions/copy-url,/usr/share/omarchy/default/chromium/extensions/yt-dlp

migrations/1784508556.sh

@@ -0,0 +1,13 @@
+echo "Pin browser password store to gnome-libsecret (prevents cookie/login loss on Hyprland)"
+
+# Chromium-based browsers auto-detect their os_crypt backend; on Hyprland the xdg-desktop-portal
+# Secret backend has no provider and fails, so they can fall back to the 'basic' (v10) store.
+# A swap from the gnome-libsecret (v11) key to the basic key makes existing cookies and saved
+# passwords undecryptable, so the browser silently drops them and the user is logged out of
+# everything. Pin gnome-libsecret so the backend is deterministic across reboots and updates.
+for conf in ~/.config/{chromium,brave,chrome,microsoft-edge-stable}-flags.conf; do
+  if [[ -f $conf ]] && ! grep -q -- '--password-store=' "$conf"; then
+    [[ -n $(tail -c1 "$conf") ]] && echo >>"$conf"
+    echo '--password-store=gnome-libsecret' >>"$conf"
+  fi
+done