- Add --write-token-file option to admin tokens create - Write token file with restrictive 0600 permissions; print only 'Token written to file: <PATH>' - Preserve optional one-time stdout display when file not provided (labelled) - Sanitize token metadata and token list by replacing token_hash with [REDACTED] - Update CLI tests to use --write-token-file and assert file content & permissions Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>