feat(token): add stored token support with resolve_token and token_source

Introduce a centralized token resolution system that supports both
environment variables and config-file-stored tokens with clear priority
(env var wins). This enables cron-based sync which runs in minimal
shell environments without env vars.

Core changes:
- GitLabConfig gains optional `token` field and `resolve_token()` method
  that checks env var first, then config file, returning trimmed values
- `token_source()` returns human-readable provenance ("environment variable"
  or "config file") for diagnostics
- `ensure_config_permissions()` enforces 0600 on config files containing
  tokens (Unix only, no-op on other platforms)

New CLI commands:
- `lore token set [--token VALUE]` — validates against GitLab API, stores
  in config, enforces file permissions. Supports flag, stdin pipe, or
  interactive entry.
- `lore token show [--unmask]` — displays masked token with source label

Consumers updated to use resolve_token():
- auth_test: removes manual env var lookup
- doctor: shows token source in health check output
- ingest: uses centralized resolution

Includes 10 unit tests for resolve/source logic and 2 for mask_token.

src/cli/commands/ingest.rs

@@ -293,10 +293,7 @@ async fn run_ingest_inner(
     );
     lock.acquire(force)?;
 
-    let token =
-        std::env::var(&config.gitlab.token_env_var).map_err(|_| LoreError::TokenNotSet {
-            env_var: config.gitlab.token_env_var.clone(),
-        })?;
+    let token = config.gitlab.resolve_token()?;
 
     let client = GitLabClient::new(
         &config.gitlab.base_url,