Token Bucket

Central place for user tokens. CLIs read from here instead of env vars.

New file `~/.sqrl/secrets.yaml`:
```yaml
tokens:
  github: ghp_xxx
  openrouter: sk-or-xxx
  anthropic: sk-ant-xxx
custom:
  my_key: xxx
```

- New "Tokens" tab in web UI (mask values, never log)
- New module `daemon/src/secrets.rs`