feat(secrets): FileStore.Delete to purge a user's OAuth tokens

Account disconnect/delete needs to remove the per-user YouTube refresh
token from the SecretStore. Add Delete(ref) on the file-backed store,
mirroring Put: atomic temp-file+rename, 0600, no-op on an absent ref.

Kept off the read-only ports.SecretStore (Get) — write/delete follow the
existing auth.TokenWriter convention of narrow capability interfaces, so
the youtube adapter's read-only dependency is unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/adapters/secrets/file_test.go

@@ -49,6 +49,40 @@ func TestPutIsOwnerOnly(t *testing.T) {
 	}
 }
 
+func TestDeleteRemovesRefAndLeavesOthers(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "secrets.json")
+	s := secrets.NewFileStore(path)
+	if err := s.Put("youtube/u1/refresh_token", "rt-1"); err != nil {
+		t.Fatalf("Put: %v", err)
+	}
+	if err := s.Put("youtube/u2/refresh_token", "rt-2"); err != nil {
+		t.Fatalf("Put: %v", err)
+	}
+
+	if err := s.Delete("youtube/u1/refresh_token"); err != nil {
+		t.Fatalf("Delete: %v", err)
+	}
+
+	// The deleted ref is gone (persisted: re-open from disk)...
+	s2 := secrets.NewFileStore(path)
+	if _, err := s2.Get(context.Background(), "youtube/u1/refresh_token"); !errors.Is(err, secrets.ErrNotFound) {
+		t.Errorf("Get deleted ref: err = %v, want ErrNotFound", err)
+	}
+	// ...and the other user's secret survives.
+	if got, err := s2.Get(context.Background(), "youtube/u2/refresh_token"); err != nil || got != "rt-2" {
+		t.Errorf("Get surviving ref = (%q, %v), want (%q, nil)", got, err, "rt-2")
+	}
+}
+
+func TestDeleteAbsentRefIsNoop(t *testing.T) {
+	// Deleting an unknown ref — or from a file that does not exist yet — is a
+	// no-op, not an error (mirrors store.DeleteConnection semantics).
+	s := secrets.NewFileStore(filepath.Join(t.TempDir(), "secrets.json"))
+	if err := s.Delete("missing"); err != nil {
+		t.Errorf("Delete absent ref: %v, want nil", err)
+	}
+}
+
 func TestPutMergesEntries(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "secrets.json")
 	s := secrets.NewFileStore(path)