fix: harden Pages, remote sync, and subscription auth

.github/workflows/ci.yml

@@ -144,6 +144,19 @@ jobs:
       - name: Run core and desktop Rust tests
         run: cargo test --locked -p bitfun-core -p bitfun-desktop
 
+      # These crates own platform-sensitive behavior that is not exercised by
+      # testing bitfun-core/bitfun-desktop alone. Keep their focused contract
+      # suites in the OS matrix so Linux success cannot hide Windows/macOS
+      # regressions in worker interruption, relay storage, or OAuth handling.
+      - name: Run Page Functions runtime tests
+        run: cargo test --locked -p bitfun-page-function-runtime
+
+      - name: Run Relay service tests
+        run: cargo test --locked -p bitfun-relay-service
+
+      - name: Run subscription authentication tests
+        run: cargo test --locked -p bitfun-ai-adapters --features subscription-auth subscription_auth
+
   # ── Frontend: build ────────────────────────────────────────────────
   frontend-build:
     name: Frontend Build

Cargo.toml

@@ -122,6 +122,10 @@ glob = "0.3"
 ignore = "0.4"
 notify = "8.2"
 dirs = "6.0"
+keyring-core = "1.0.0"
+apple-native-keyring-store = { version = "1.0.1", features = ["keychain"] }
+windows-native-keyring-store = "1.1.0"
+zbus-secret-service-keyring-store = { version = "1.0.0", features = ["crypto-rust"] }
 dark-light = "1.1"
 dunce = "1"
 filetime = "0.2"