Design token persistence for a containerized/multi-host deployment

[mregen]

Current TokenStore writes directly to the local dotnet user-secrets file, which assumes a single local dev machine. Revisit for any hosting scenario beyond that (mounted volume, external secret store, etc.) - same open question fatsecret-mcp has for its own token persistence.

[mregen]

Overlaps with #12 (IHealthTokenStore + CloudTokenStore) under the new "Cloud multi-tenant service" milestone - see docs/cloud-deployment.md for the concrete design (SQLite-backed, per-user, encrypted at rest). Leaving both open for now, close this as a duplicate once #12 actually starts.