macOS derives the OSCrypt key from a single keychain secret. Linux is looser: a
database can mix `v10` records (a hardcoded `peanuts` passphrase, used when no
keyring is present) and `v11` records (a libsecret/kwallet secret), so both keys
are derived up front and the record's prefix picks between them. A locked or
absent keyring is not fatal — those `v11` records are skipped and the rest still
import.

Key acquisition moves into its own `ChromiumKeys` module; `ChromiumCookies` now
decrypts each record by the scheme its prefix names and skips any it holds no
key for, so a partial result is reported honestly rather than failing the whole
import.

Windows is deliberately left out: since Chrome 127 its cookies are encrypted to
the browser's own identity (App-Bound Encryption) and cannot be read by another
process, so those forks are not offered there at all.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>