feat: forward OP_SERVICE_ACCOUNT_TOKEN to container

[sd0xdev]

Why

When running Moltbot/OpenClaw in the Cloudflare Sandbox container, users often want to use the 1Password CLI (op) inside the container to fetch/inject secrets non-interactively.

The op CLI expects a Service Account token in OP_SERVICE_ACCOUNT_TOKEN, but the worker currently does not forward this variable into the container process environment.

What

• Add optional OP_SERVICE_ACCOUNT_TOKEN binding to the worker environment type.
• Whitelist/forward OP_SERVICE_ACCOUNT_TOKEN into the gateway container process env (similar to other allowed vars).
• Redact secrets when logging the generated config on startup to avoid leaking tokens/API keys in logs.
• Add a unit test covering the new env forwarding.

Benefits

• Enables secure, automated 1Password Service Account auth for op inside the container (no interactive signin).
• Keeps security posture: token value is never logged; startup config logs are redacted.
• Fully backwards compatible (optional env; no behavior change when unset).

How to use

wrangler secret put OP_SERVICE_ACCOUNT_TOKEN
wrangler deploy