fix(storage): stop persisting CloudSyncConfig secrets to disk

[shiba4life]

Summary

`CloudSyncConfig` was serializing `api_key`, `session_token`, and `user_hash` into `node_config.json` alongside `api_url`. Those are per-device secrets that belong in the host application's credential store (e.g. fold_db_node's `credentials.json` / `credentials.enc`) — not in plaintext JSON that may be backed up, shared, or checked into a mis-gitignored directory.

Mark those three fields `#[serde(default, skip_serializing)]`:

• new saves write only `api_url` inside `cloud_sync`
• old files that already contain these fields still deserialize cleanly (the next save strips them)
• the runtime still holds the fields in-memory, hydrated by the host app (e.g. `FoldNode::new` loading from credentials)

Finding #3 of the cloud-sync-activation review.

Test plan

• `cargo test --lib storage::config` — all 9 tests pass (6 existing + 3 new)
• `cargo clippy --workspace --all-targets -- -D warnings` clean
• CI green
• Cascade: fold_db_node Cargo.lock bump picks up the change; existing sync-activation tests must still pass

New tests

• `serialize_omits_per_device_secrets` — proves api_key/session_token/user_hash don't appear in JSON output
• `deserialize_tolerates_legacy_files_with_secrets` — proves old files still load
• `deserialize_new_file_without_secrets_defaults_fields` — proves new files default the fields cleanly

🤖 Generated with Claude Code