- Add --write-token-file option to admin tokens create
- Write token file with restrictive 0600 permissions; print only 'Token written to file: <PATH>'
- Preserve optional one-time stdout display when file not provided (labelled)
- Sanitize token metadata and token list by replacing token_hash with [REDACTED]
- Update CLI tests to use --write-token-file and assert file content & permissions
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>