Store OAuth credentials in SQLite databases

[ringomax]

Fixes #268

Summary

• Store durable OAuth credentials in credentials.db and short-lived access tokens in access_tokens.db.
• Limit the configuration directory to the owner and protect the databases, lock files, and debug logs with owner-only file permissions.
• Require Node.js 22.5 or later for the built-in SQLite API.
• Avoid writing custom HTTP header values or token objects to logs.
• Document the credential reset and reauthorization flow for the new storage format.

Validation

• pnpm exec vitest run - 108 tests passed
• pnpm exec tsc --noEmit
• pnpm exec prettier --check .
• pnpm exec tsup

Compatibility

Existing ~/.mcp-auth records are not imported automatically. Reauthorization stores each connection in the new SQLite databases.

Refs #200