Implement Apollo CLI credential storage and auth commands

## Background Refs #5624 and #5625. Apollo CLI v0 uses existing Consumer token authentication. Since Consumer tokens may grant access to sensitive configuration data, the CLI needs a secure credential storage abstraction before broad OpenAPI commands are implemented. ## Goal Implement credential storage and the first auth commands for the `apollo` CLI. ## Credential store abstraction Add an internal credential-store abstraction with logical providers: - native OS credential store - environment token provider through `APOLLO_TOKEN` - explicit file fallback, only when opted in - in-memory/test provider for unit tests Default native behavior: - macOS: Keychain Services - Windows: Credential Manager - Linux desktop: freedesktop Secret Service over D-Bus when available - Linux headless/CI: do not require a desktop keyring; prefer `APOLLO_TOKEN` The implementation may use a Rust cross-platform keyring crate or an equivalent backend, but command handlers should depend on the internal abstraction rather than backend-specific APIs. ## Commands Implement: - `apollo auth login` - `apollo auth status` - `apollo auth logout` `auth login` should accept a token without shell-history leakage, for example through prompt, stdin, or environment-assisted setup. `auth status` should show whether credentials are resolvable for the selected profile, but must not display token values. `auth logout` should remove credentials from the active credential backend and leave non-secret profile config intact unless explicitly requested otherwise. ## File fallback File-based token fallback must be explicit, for example: - `apollo auth login --store-token-in-file` - interactive warning and confirmation if native credential storage is unavailable If used, fallback files should use restrictive permissions where supported, for example `0600` on Unix. ## Out of scope - Calling Apollo OpenAPI endpoints beyond optional auth validation if explicitly designed. - Agent session authorization. - Storing token material in profile config by default. ## Acceptance criteria - Native credential storage is attempted by default where supported. - `APOLLO_TOKEN` works for CI/headless usage without writing credentials to disk. - File fallback requires explicit opt-in. - `auth login/status/logout` use the credential-store abstraction. - Auth output never prints token values. - Credential backend behavior is covered by unit tests with an in-memory/test provider. - Platform-specific behavior is documented.