feat: improve linux support

.github/workflows/release-cli.yml

@@ -182,6 +182,31 @@ jobs:
             artifacts/*.zip
             artifacts/sha256sums.txt
 
+  # ── Publish to Snap Store ────────────────────────────────────────────────
+  snap:
+    name: Snap
+    needs: [preflight, release]
+    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry-run) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.preflight.outputs.tag }}
+
+      - name: Set snap version
+        run: |
+          sed -i "s/^version:.*/version: \"${{ needs.preflight.outputs.version }}\"/" snap/snapcraft.yaml
+
+      - uses: snapcore/action-build@v1
+        id: build
+
+      - uses: snapcore/action-publish@v1
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+        with:
+          snap: ${{ steps.build.outputs.snap }}
+          release: stable
+
   # ── Update Homebrew tap ──────────────────────────────────────────────────
   # Disabled: the first Homebrew submission must be manual.
   # Uncomment after solana-foundation/homebrew-tap has the pay formula.

README.md

@@ -30,19 +30,26 @@ Supports both live payment standards on Solana:
 
 SOL and SPL tokens (USDC, USDT, etc.) are supported out of the box.
 
-### Touch ID & 1Password Key Storage
+### Touch ID, GNOME Keyring & 1Password Key Storage
 
 Your keys never touch disk in plaintext. `pay` stores keypairs in:
 
 - **macOS Keychain** with Touch ID biometric protection
+- **GNOME Keyring** with password/fingerprint prompt on every use (Linux)
 - **1Password** vault integration (cross-platform)
 - **File-based** fallback for CI and scripting
 
 ```sh
-pay setup --backend keychain    # Touch ID protected
-pay setup --backend 1password   # Cross-platform vault
+pay setup    # Touch ID on macOS, GNOME Keyring on Linux, or choose 1Password
 ```
 
+> **Linux note:** GNOME Keyring auth uses polkit, which requires a one-time setup step:
+> ```sh
+> sudo cp rust/config/polkit/sh.pay.unlock-keypair.policy /usr/share/polkit-1/actions/
+> ```
+> This grants `pay` the right to prompt for your password or fingerprint before
+> accessing the keypair. Without it, `pay topup` and `pay curl` will error.
+
 ### Session Budgets via TUI
 
 Set a spending cap and expiration before making requests. The interactive TUI lets you control exactly how much you're willing to spend per session — no surprise charges.
@@ -79,6 +86,12 @@ cd pay/rust
 cargo install --path crates/cli
 ```
 
+**Linux only** — install the polkit action to enable keypair auth:
+
+```sh
+sudo cp rust/config/polkit/sh.pay.unlock-keypair.policy /usr/share/polkit-1/actions/
+```
+
 ### Verify
 
 ```sh