Harden saved auth storage

[brahimhamichan]

Summary

• replace plaintext saved API key storage with AES-256-GCM encrypted local storage
• preserve FATHOM_API_KEY precedence, add legacy config.json migration, and surface auth storage metadata in auth commands
• document the new auth model and add config + CLI coverage for encrypted auth, migration, and corrupted state handling

Testing

• npm test