Encrypt OAuth tokens at rest

[ryw]

Summary

Implement AES-256-GCM encryption for OAuth tokens stored on disk to address security vulnerability #31. Tokens are now encrypted using a machine-specific key derived from hostname, username, and home directory, ensuring they're only decryptable on the same machine by the same user. Added SecureTokenStorage utility class with automatic migration from plaintext (legacy) to encrypted format.

Key changes:

• New SecureTokenStorage class with encrypt() and decrypt() methods using AES-256-GCM
• Machine-specific key derivation via scryptSync() prevents token portability across machines
• Automatic migration of legacy plaintext tokens to encrypted format on load
• Maintains file permissions (0o600) for defense in depth
• Graceful handling of decryption failures with user-friendly warnings

Want tembo to make any changes? Add a review or comment with @tembo and i'll get back to work!