docs: fix two broken README snippets and nine stale claims before 2.0.0

[StuartMeeks]

Full README review ahead of 2.0.0. Twelve findings; the two code ones were verified by running them, and so were the replacements.

Two snippets that did not work

1. The DPAPI example could not resolve.

services.AddSingleton<ICredentialManager, FileCredentialManager>();   // throws

FileCredentialManager takes a string credentialsDirectory:

InvalidOperationException: Unable to resolve service for type 'System.String'
  while attempting to activate 'FileCredentialManager'.

Replaced with an explicit factory registration — which also passes GetServices<ICredentialSummaryProvider>(). That detail matters beyond compiling: without it the provider columns silently disappear from accounts list. The replacement is verified end to end (add + list, provider columns=1).

2. The custom-encryption advice was backwards, and failed silently.

The README said register your ICredentialEncryption before AddCredentialStore. But AddCredentialStore registers its own, and last registration wins:

registered before AddCredentialStore -> resolved: LocalFileCredentialEncryption

So a custom backend registered first was ignored, and credentials kept using the default — with no error, on a change made specifically to strengthen encryption. That is the worst available failure mode for this particular piece of advice. Now documents after, explains why order matters, and gives a one-liner to verify. Confirmed: resolved=MarkerEncryption.

Stale after this cycle

• The libsecret intro still advertised "KWallet's shim, any Secret Service implementation" and Seahorse/KWalletManager — twenty lines above the block declaring KWallet unsupported.
• That block still blamed "invoked without a cancellable". libsecret calls can block forever when the Secret Service prompts #74 disproved it: the cancellation fires and the call still never returns, because ksecretd sends ao where libsecret expects o on the prompt's Completed signal. Now states the actual upstream cause.
• "operations will throw with a clear message" omitted that they can instead block.
• Contributing pointed at libsecret calls can block forever when the Secret Service prompts #74, now closed.

Missing

• Cancellation — 2.0.0's headline change, unmentioned.
• export/import absent from the features list.
• accounts list marking rows (unreadable).
• accounts export skips credentials it cannot read and warns. Called out beside the "Fidelity" bullet, which previously read as though everything is always preserved. An archive can be legitimately incomplete — and the reason is worth stating, since exporting a blank payload instead would restore over a real secret at the far end.
• Providers.GitHub ships at 1.0.1 and was missing from the table — while the worked example teaches you to build a GitHub provider from scratch. Now listed, and the example says so.
• "Three interfaces" corrected to what the sample actually defines.

Verification

Build clean; no code changed. Both new snippets executed successfully, and all external links resolve.

🤖 Generated with Claude Code