feat(infra): OS keychain token storage #112

Summary

Store OAuth tokens in OS keychain (macOS Keychain, Linux Secret Service) instead of plain JSON file at ~/.config/gws/token.json.

Priority: P2 | Complexity: Medium

Motivation

Both bkt (go-keyring) and gogcli use keyring-based credential storage. Storing tokens in plaintext JSON is a security concern.

Implementation

• Use go-keyring library
• Store/retrieve tokens via OS keychain by default
• Fall back to file-based storage if keychain unavailable
• Add --no-keychain flag to gws auth login to opt out
• Migration: auto-migrate existing token.json to keychain on first use