A credentials section for Claude's setup token #1010

Parent

#977

What to build

• The credentials file accepts a section for a Claude setup token, made with claude setup-token. It's kept with mode 0600, as the Resend key is, and never printed or logged.
• Setup asks for it with hidden input, and saves it.
• Only Trials use it. The Trial sandbox: bwrap, its own processes, fresh homes and logins #1012 passes it as CLAUDE_CODE_OAUTH_TOKEN.

Acceptance criteria

• The credentials file accepts the new section, and still rejects unknown keys.
• Setup asks for the token with hidden input and saves it, and the file stays 0600.
• The token never appears in output, logs or Command records.