access_token vs passphrase and passcommand

[hermannsorgel]

Hi there! Thanks for the great work on Vykar

I was looking through the configuration design and noticed a small difference in how secrets are handled: there's passcommand for fetching the encryption passphrase securely, but the access_token for repo credentials has to be plain text in the config file.

I'm curious why these two are treated differently. I know ${VAR} expansion can work around this in practice, so this isn't a bug report or feature request — just genuine curiosity about the design. Is there a specific reason access_token is handled this way?