Offer to save a password when a login is submitted

Submitting a form containing a password now offers to remember it.

It goes into the macOS Keychain, through the Security framework rather
than the `security` binary - a password passed as a command-line argument
is visible in `ps` to anyone on the machine, however briefly. Never
apps.json, never a log.

The value travels as little as it can: the injected script hands it
straight to Rust, which holds it in memory and tells the shell only which
host and which username, since that is all the shell needs to ask the
question. It is written on Save and dropped on anything else.

Autofill is deliberately not built. Reading a password back out and
injecting it into a page is a materially larger surface than offering to
store one, and deserves its own decision.

docs/superpowers/specs/2026-09-01-work-app-design.md

@@ -314,6 +314,20 @@ on a blocking worker rather than the calling thread — its completion handler r
 main thread, and waiting for it *there* deadlocks until the timeout and returns nothing
 every time.
 
+## Passwords
+
+Submitting a form that contains a password offers to remember it, the way a browser does.
+
+It goes into the **macOS Keychain** — encrypted at rest, unlocked with the login session,
+and the one place on this machine actually built to hold a password. Never `apps.json`,
+never a log.
+
+The value also travels as little as possible: the injected script hands it straight to
+Rust, which holds it in memory and tells the shell only *which host* and *which username*,
+because that is all the shell needs to ask the question. It is written on Save and dropped
+on anything else. Autofill is not built — reading a password back out and injecting it into
+a page is a larger surface than offering to store one, and worth deciding on separately.
+
 ## Zoom
 
 Per app, on a fixed ladder so ⌘0 returns to exactly 100% rather than to whatever a