Isolate inline OAuth token caches

[ryanduguid]

What changed

• derive inline-credential cache keys from the client identity instead of one global _inline key
• track and clean up legacy and derived keys through profile add, remove and logout flows
• keep named-profile cache behaviour unchanged
• document the cache lifecycle

Why

Two inline client configurations in the same user environment previously shared one token-cache key. That could make the second invocation load or overwrite tokens belonging to the first OAuth client.

Checks

• npm ci
• npm test -- --run test/lib/credential-cache-key.test.ts test/commands/oauth-cache-lifecycle.test.ts (13 passed)
• npm run build
• git diff --check

All cache/keyring interactions are mocked by the tests.