feat(config): add state.toml + keychain store and migrate config.toml (1/2)

[LorrisSaintGenez]

What

• Add state.toml (non-secrets) + OS keychain (secrets) as the new credential source of truth, migrated once from config.toml at startup.
• Resolve credentials on read from the new store with a config.toml fallback; commands still write config.toml (the write flip lands in the stacked follow-up PR).
• Deprecate the --profile flag (still resolved via stored aliases until v2.0).

Test

• With an existing config.toml, run algolia indices list once: it migrates to state.toml (application id + alias, no secret) and the OS keychain (API key), then succeeds — config.toml is left intact.
• Rename config.toml and re-run algolia indices list: still works, confirming reads now resolve from state.toml + keychain (and no re-migration happens).
• Run algolia --profile <alias> indices list: resolves via the stored alias and prints the --profile deprecation notice.

Made with Cursor

GROUT-305

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 critical

Alerts:

⚠ 1 issue (≤ 0 issues of at least high severity)

Results:
1 new issue

Category	Results
Security	1 critical

View in Codacy

🟢 Metrics 6 duplication

Metric	Results
Duplication	6

View in Codacy

_{TIP This summary will be updated as you push new changes.}