feat(cli): add token-store policy visibility and plaintext warnings

[smekcio]

Summary

• expose token-store mode in diagnostics and health check
• emit explicit warning when plaintext fallback storage is actually used
• keep secure-by-default token storage behavior unchanged

Changes

• Added token-store mode resolver with values:
  • keyring
  • encrypted-fallback
  • plaintext-fallback
  • unavailable
• Extended health check output with token_store check (without duplication)
• Added one-time runtime warning for plaintext fallback usage
• Added unit/integration tests for mode detection, warnings, and health output
• Updated CLI docs

Validation

• python -m pytest -q
• Result at submission time: 405 passed, 4 skipped