feat: add macOS Keychain support for secure credential storage

[BayramAnnakov]

Summary

Add support for storing Telegram API credentials in macOS Keychain instead of plain text .env files.

Changes

• Add get_credential_from_keychain() function to read from macOS Keychain
• Add get_credential() wrapper that tries Keychain first, falls back to environment variables
• Update credential loading to use the new functions
• Full backward compatibility: existing .env setups continue to work

Usage

Store credentials in Keychain:

security add-generic-password -a "api_id" -s "telegram-mcp" -w "YOUR_API_ID" -U
security add-generic-password -a "api_hash" -s "telegram-mcp" -w "YOUR_API_HASH" -U
security add-generic-password -a "session_string" -s "telegram-mcp" -w "YOUR_SESSION_STRING" -U

Benefits

• Credentials never stored in plain text on disk
• Protected by macOS security (Touch ID, password)
• Not accidentally committed to git
• No changes required for existing users (falls back to .env)

Platform Support

• macOS: Full Keychain support
• Linux/Windows: Falls back to environment variables (no change in behavior)

🤖 Generated with Claude Code

[iqdoctor]

pls fix black

[chigwell]

Hi @BayramAnnakov, and thank you for your contribution. This PR seems very useful, and we really appreciate your suggestion. However, I'd prefer not to include the subprocess dependency in main.py, nor to run

subprocess.run(["security", "find-generic-password", "-a", account, "-s", service, "-w"])

in each MCP instance. Instead, I'd prefer to keep this in a separate python script (see, e.g. session_string_generator.py) so it's only run by the developers who actually need it. Thank you.

[BayramAnnakov]

Makes sense, will address