fix: migrate legacy client credentials

[bradtaylorsf]

Summary

• add a supported migrate-legacy-credentials installer action
• replace legacy raw-key Claude/Codex/Cursor/Claude Desktop MCP entries with keyless managed Docker launchers
• preserve unrelated MCP configuration and private mode-0600 backups
• document and record the verified local overlap rotation

Security review

• no live token material is present in the commit, output, or acceptance record
• the old protected local installer token was revoked only after the replacement authenticated
• active Claude and Codex configs contain no raw Answer Engine key
• the API, local database services, and recurring sync remain local and healthy

Verification

• pnpm verify
• pnpm --filter @answer-engine/create test
• pnpm --filter @answer-engine/create type-check
• pnpm --filter @answer-engine/create build
• live stable API health and replacement authentication
• live launchd sync: Claude, Codex, and Cowork imports with zero failures/parse errors

Closes #74