Remove local credential importing

[grikomsn]

Summary

• remove all reads and imports from the local OpenCode credential database
• require explicit API-key or Console device-code authentication initiated in VS Code
• update commands, manifest, tests, and security/setup documentation

Verification

• npm run check
• npm run package
• packaged executable and manifest contain no local credential-import implementation

Visual Studio Marketplace publishing remains disabled.