Implement dedicated token storage handling across sessions and directories

[kordless]

Following on to #1

[kordless]

Token storage plan across sessions/directories:

• Standardize token storage in per-workspace env files (e.g., .github-discussion.env, .nuts.env, .serpapi.env) with a documented precedence: env var > workspace env file.
• Avoid writing to /opt; load from workspace on startup and log which tokens are present/missing.
• Add a small helper to mask/show token presence (github_status, serpapi_status, etc.) and warn when MCP tools are disabled due to missing creds.
• Include guidelines for rotating tokens (delete the env file or overwrite) and for multi-repo use: one env file per workspace, not global.
• Update README and example env templates to show the recommended pattern.

[kordless]

We still don’t have a dedicated token-store abstraction beyond the .codex-home/.codex/sessions/... env files + .codex-container.toml env_imports. To actually close this we need:

1. A canonical location (e.g., ~/.codex-service/tokens/) with read/write helpers so tools/scripts don’t each roll their own .env parsing.
2. CLI commands or MCP tool(s) to list/set/delete tokens by name (similar to how gh auth stores credentials).
3. Docs describing how the container maps host tokens into Codex (and vice versa) so users know where to update secrets.

Right now tokens are just regular env vars and ad-hoc .env files, so this issue remains open.