Unlock the database on every KeePassXC start, not just at login

A restarted KeePassXC (Restart=on-failure, or any manual restart) comes
back with the database locked, and cce-keyring-unlock.service is a
login-time oneshot that has long since run — so the session was left
with a locked Secret Service and no way back except typing the master
password.

Bounded on purpose: ExecStartPost counts against TimeoutStartSec (90s
here), and overrunning it makes systemd fail the start and kill the unit
— KeePassXC with it — which Restart=on-failure would then loop. The 45s
cap clears the measured 3s warm unlock with room to spare, and the
leading '-' keeps a failed unlock from taking KeePassXC down.

Verified by restarting the unit: fresh KeePassXC came up locked at
10:48:33 and the database was unlocked and verified by 10:48:36.

Co-Authored-By: Claude Fable 5 <[email protected]>

 cce-keepassxc.service | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/cce-keepassxc.service b/cce-keepassxc.service
index 4cd290e..6172c8b 100644
--- a/cce-keepassxc.service
+++ b/cce-keepassxc.service
@@ -7,6 +7,17 @@ PartOf=graphical-session.target
 [Service]
 Type=simple
 ExecStart=/usr/bin/keepassxc
+# A restarted KeePassXC comes back with the database LOCKED, and
+# cce-keyring-unlock.service is a login-time oneshot that has long since run —
+# so unlock here too, on every start. At login this just does the same work
+# marginally earlier and that unit then no-ops.
+#
+# Bounded deliberately: ExecStartPost counts against TimeoutStartSec (90s by
+# default here), and overrunning it makes systemd fail the start and kill the
+# whole unit — KeePassXC with it — which Restart=on-failure would then loop.
+# 45s clears the ~3s warm unlock with room to spare. Leading `-`: a failed
+# unlock must never take KeePassXC down with it.
+ExecStartPost=-/usr/bin/timeout 45 %h/.local/bin/cce-keyring-unlock
 # The provider every keyring client waits on: bring it straight back if it
 # dies rather than leaving the session without a Secret Service.
 Restart=on-failure