Build encrypted token storage

Part of #2

Securely store OAuth tokens at rest.

**Tasks:**
- [ ] AES-256-GCM encryption
- [ ] PBKDF2 key derivation
- [ ] JSON storage format (`~/.infershield/tokens.json`)
- [ ] Read/write/delete operations

**Security:**
- Master key from `INFERSHIELD_MASTER_KEY` env var
- Random IV per token
- Store: {iv, authTag, ciphertext}