Route Secret Service D-Bus activation into cce-keepassxc.service

The first client to touch org.freedesktop.secrets at login (cce-mail's
keyring lookup beats graphical-session.target) was activating a bare
keepassxc via the hand-written override in ~/.local/share/dbus-1 — the
unit's own instance then found the name taken, handed off (KeePassXC is
single-instance) and exited, leaving the provider unmanaged: no Restart
coverage, no unlock on respawn. The override now carries SystemdService=
so both start paths converge on the unit, and it is versioned here
instead of hand-written. Verified live: kill the provider, touch the bus
name, and it is back under the unit and unlocked in ~5s.

Also ExecCondition on the display socket: at logout the compositor dies
first, KeePassXC exits 1 on the broken Wayland connection, and Restart
spun Qt against a dead display — four attempts and a coredump per
logout. A failed condition skips those restarts cleanly.

Co-Authored-By: Claude Fable 5 <[email protected]>

 cce-keepassxc.service                |  5 +++++
 dbus/org.freedesktop.secrets.service | 17 +++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/cce-keepassxc.service b/cce-keepassxc.service
index 6172c8b..cefde0b 100644
--- a/cce-keepassxc.service
+++ b/cce-keepassxc.service
@@ -6,6 +6,11 @@ PartOf=graphical-session.target
 
 [Service]
 Type=simple
+# Don't launch (or relaunch) into a session that is gone: at logout the
+# compositor dies first, KeePassXC exits 1 on the broken Wayland connection,
+# and Restart then spun Qt against a dead display — four attempts and a
+# coredump per logout. A failed condition skips the start cleanly instead.
+ExecCondition=/bin/sh -c '[ -n "$WAYLAND_DISPLAY" ] && [ -S "$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY" ]'
 ExecStart=/usr/bin/keepassxc
 # A restarted KeePassXC comes back with the database LOCKED, and
 # cce-keyring-unlock.service is a login-time oneshot that has long since run —
diff --git a/dbus/org.freedesktop.secrets.service b/dbus/org.freedesktop.secrets.service
new file mode 100644
index 0000000..2617cfa
--- /dev/null
+++ b/dbus/org.freedesktop.secrets.service
@@ -0,0 +1,17 @@
+# Shadows /usr/share/dbus-1/services/org.freedesktop.secrets.service (which
+# would activate gnome-keyring) so the Secret Service is KeePassXC — and
+# specifically KeePassXC under cce-keepassxc.service, whose ExecStartPost
+# unlocks the database.
+#
+# SystemdService, not a bare Exec: the first client to touch the bus name at
+# login (cce-mail's keyring lookup beats graphical-session.target) was
+# activating a bare keepassxc that then owned the name outside the unit — the
+# unit's own instance found the name taken, handed off (KeePassXC is
+# single-instance) and exited, leaving the provider with no Restart coverage
+# and no unlock-on-respawn. With SystemdService both start paths converge on
+# the one unit. Exec is the spec-required fallback and must never fire on a
+# systemd user bus.
+[D-BUS Service]
+Name=org.freedesktop.secrets
+Exec=/usr/bin/false
+SystemdService=cce-keepassxc.service