pub fn get_optional(
account_id: &str,
) -> Result<Option<Zeroizing<String>>, String>Expand description
Read the secret for account_id, distinguishing “no entry stored yet”
(Ok(None)) from a real storage failure (Err) — a locked keychain, no
Secret Service daemon running, permission denied, etc. get collapses
both into the same Err variant, which is correct for its own callers
(a spawn-time credential resolve should fail either way), but is the
wrong shape for a caller that needs to tell “genuinely never logged in”
apart from “storage is transiently broken” — treating a transient
failure as “no credential” can silently present as a full logout. Use
this variant when that distinction matters.