release 0.8.0

Added (#41)

• Encrypted credential store. API keys and tokens are stored encrypted (AES-256-GCM) in credentials.v2.json, under a key held by the macOS Keychain, Windows DPAPI or the Linux Secret Service. Where none is available (CI, containers, SSH sessions, a HOME without a keychain, or MESHY_KEYRING=file) the key is a 0600 file next to the credentials.
• Signed-in account. auth status and auth list report account (name and email) when the site provides it; logins ask for openid profile email. Logins made before 0.8 show it after the next sign-in.
• auth status --show-token prints the credential, for host apps that hand it to sandboxed tools.
• Host-provided session. DSH_MESHY_CREDENTIAL, DSH_MESHY_REGION, DSH_MESHY_SUBJECT and DSH_MESHY_STATE_DIR let the DeepSeek Harness plugin give its sandboxed shells a current credential and a writable directory for the operation journal.

Fixed (#41)

• A shell that cannot write the credentials directory (a sandboxed agent) no longer loses its login. An expired token used to be refreshed there and the result could not be saved, which ended the login. The CLI now skips the refresh: a valid token keeps working, an expired one exits 3 with the stored login intact. auth login checks the directory before it starts a flow.
• A token refresh no longer drops the profile's region; a China-site login stayed on the China site only until its first refresh.

Changed (#41)

• OAuth tokens are refreshed 30 minutes before they expire, so a long wait does not outlive its token.
• The pre-0.8 plaintext credentials.json is read until the first write, which moves its profiles into the encrypted file and deletes it. An older CLI on the same machine then signs in once on its own.