Mask API tokens in auth:token --list

[joetannenbaum]

auth:token --list printed saved API tokens in full, in the table and in the JSON. Every other secret in the CLI is masked by default, and this one is the most valuable of the lot: --list is documented with -n, which means JSON, so a live credential ends up in CI logs and agent transcripts from a command whose job is just to name the source of each token.

Tokens now show as ***** plus their last four characters, which is enough to tell apart two tokens for the same organization. --show-sensitive prints them in full.

The masking elsewhere runs through DTO transformers, but this command built a raw array, so nothing applied. It now builds an ApiToken DTO, which also keeps --show-sensitive working.