fix(auth): improve token setup and loading states

[taiiiyang]

Summary

• keep the options PAT input in sync with persisted storage and add a show/hide toggle
• gate the PR score card on token validity so missing or invalid tokens show clear setup guidance instead of hanging in loading
• reuse the token banner for missing/invalid states and add localized copy for the new auth flows

Testing

• pnpm lint
• pnpm check
• pnpm build