fix: read agy token from Windows Credential Manager (API path falls back to PTY on Windows)

[abruption]

On Windows the direct API path can't read the token, so it falls back to the slow PTY path.

Root cause

agy stores the token in Windows Credential Manager via Go's zalando/go-keyring, with target gemini:antigravity (user antigravity). Our reader uses @napi-rs/keyring (Rust keyring-rs), which uses a different target-name format, so it never finds it. No token file exists on Windows either.

Fix

Add a Windows-only backend that reads the credential with target gemini:antigravity directly via the Win32 CredRead API (built-in powershell.exe, no new dependency). Insert into the chain: keyring(napi) → cli → Windows credman → file → PTY.

Acceptance

• Windows: API path works (source: api, no PTY fallback)
• macOS/Linux unaffected (reader no-ops off Windows)
• decode handled by existing decodeSecret (go-keyring-base64 or plain JSON)