Require explicit plaintext auth storage

[jlitola]

Summary

• Add config.toml auth storage mode with keychain default and explicit file mode for plaintext OAuth storage.
• Stop silently downgrading keychain failures to plaintext files, while preserving legacy ~/.githits migration and logout cleanup.
• Improve auth command dependency flow, storage error UX, atomic file writes, docs, and regression coverage.

Verification

• bun test
• bun run typecheck
• bun run build
• Built CLI smoke checks for help, auth status, file mode, env-token bypass, invalid config errors, and logout.