feat: add credential encryption key config and improve service token CLI display

- Add CREDENTIAL_ENCRYPTION_KEY environment variable with Fernet key generation guide
- Improve service token issue command to display raw token once with warning
- Refactor token list display function for better UX (new print_service_token_list)
- Keep backward compatibility with print_service_token_table alias

.env.example

@@ -14,6 +14,10 @@ PORTFOLIOHUB_SESSION_TOKEN_TTL_HOURS=12
 PORTFOLIOHUB_CLIENT_TOKEN_DEFAULT_TTL_DAYS=365
 PORTFOLIOHUB_BOT_TOKEN_DEFAULT_TTL_DAYS=365
 
+# Credential encryption key (Fernet, required when DB_ENABLED=true)
+# Generate: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+CREDENTIAL_ENCRYPTION_KEY=
+
 # TimescaleDB / PostgreSQL connection settings
 TIMESCALEDB_HOST=localhost
 TIMESCALEDB_PORT=5432