fix(security): redact token helper output

[saagpatel]

What

• Stops the OAuth refresh-token helper from printing masked client secret and refresh token values.
• Replaces those lines with presence/status messages that do not include secret-derived data.

Why

• CodeQL flagged scripts/test/get_refresh_token.py for clear-text logging of sensitive information.
• Even masked secret output is unnecessary in local validation logs.

How

• Keeps the helper writing secrets to the secure env file path.
• Changes terminal output to confirm configuration/write status only.

Testing

• python3 -m py_compile scripts/test/get_refresh_token.py passed locally.

Performance Impact

• None expected.

Risk / Notes

• Local /Users/d/Projects/visual-album-studio has unrelated dirty docs/config files; this PR only changes scripts/test/get_refresh_token.py through GitHub.