gh auth status should indicate when a token is stored in plain text

Describe the feature or problem you'd like to solve

When a token is stored in the plaintext hosts.yml fallback — because the system keyring is unavailable, or the user passed --insecure-storage — gh auth status gives no indication that the token is stored in plain text, nor how to move it into the keyring. The only signal is a one-time yellow warning at login time, which is easy to miss. A user who fell into the plaintext fallback has no ongoing way to notice or remediate it.

Proposed solution

In gh auth status, when a host's active token source is oauth_token (plaintext config) rather than keyring, show a warning plus a remediation hint, mirroring the existing missing-scopes warning idiom:

  ! Token stored in plain text
  - To store your token in the system keyring, run: gh auth login -h <host>

This is display-only — no change to storage behavior, flags, or the --json output schema.

Additional context

Happy to open a PR — I already have a small, tested change prepared (adds the warning in pkg/cmd/auth/status/status.go, keyed off the existing oauth_token source check in buildEntry, with tests).