fix: secure provider credential storage

[N1ghthill]

Summary

• move provider API keys and GitHub tokens out of project config into a private, project-scoped user credential store
• migrate legacy plaintext credentials safely, purge transient copies, and redact exact copies in sessions, telemetry, and logs
• enforce POSIX 0700/0600 permissions, mandatory agent path blocks, cache redaction, and secret-free child-process environments
• add config credentials-path and document the storage and migration model

Compatibility

• config show/get/set/unset and the TUI retain their existing behavior
• environment variables remain runtime-only
• apiKeyFile remains supported
• a non-secret local scope ID keeps credentials associated when a project is moved

Validation

• corepack pnpm validate
• npm pack --dry-run --json (terminuz: 7 expected files)
• local migration verification: no plaintext credential fields or token-shaped values remained in the affected project state

Release

This is a security fix and should receive a patch release after merge.