[codex] Use HF token file for app auth

[peteromallet]

Summary

• Make the Mac app use ~/.cache/huggingface/token as the sole Hugging Face auth source.
• Remove the Rust Keychain dependency and stale Auth page copy.
• Stop inheriting parent-process HF_TOKEN into sidecar runs so app auth state matches sidecar behavior.
• Fix scripts/build-sidecar.sh so the smoke test respects the configured PYTHON binary.

Why

The previous app auth path wrote both macOS Keychain and the Hugging Face token file. If the token file disappeared and Keychain access failed, the UI could report the token as missing even though the user had pasted and used it before. File-only auth matches Hugging Face CLI behavior and avoids Keychain permission/signing edge cases.

Validation

• TAURI_CONFIG='{"bundle":{"externalBin":[]}}' cargo test -q -p dataclaw-app
• PYENV_VERSION=3.11.11 python -m pytest tests/test_config.py tests/test_cli_common.py -q
• pnpm -C app build
• PYTHON=/tmp/dataclaw-sidecar-venv/bin/python make build-sidecar
• make release-local

Notes

The rebuilt local app was launched from app/src-tauri/target/release/bundle/macos/DataClaw.app.

[peteromallet]

Pushed the auth change directly to main in acc76fb, closing this draft PR.