Broker credentials without ever seeing them.

Secrets live in the macOS Keychain under service name "neuron", one per
account name. The user stores them once, outside of any chat transcript:

    security add-generic-password -s neuron -a gitea-token -w <secret>

This tool reads a secret from the Keychain, uses it to perform the requested
operation, and returns only results — the secret itself is never printed,
returned, or logged. If an output would contain the secret it is replaced
with [redacted].

Actions:

- `gitea-api`: call the Gitea API at git.neuralplatform.ai with the stored
  `gitea-token` credential. Provide `path` (after /api/v1/), optional HTTP
  `method` (default GET) and JSON `body`. Returns status and response body.
- `check`: verify that a named Keychain credential exists. Never returns the
  value.

If a required credential is missing, tell the user to store it with the
security command above rather than pasting secrets into the conversation.
