auth: Ignore tokens.json so Login output is not git-added

Login writes access/refresh tokens (and often client_secret) to
tokens.json at mode 0600. Without a gitignore entry, git add . after a
local login can stage live Agentic credentials.

Closes: #20

.gitignore

@@ -3,3 +3,6 @@
 bin/
 *.exe
 coverage.out
+
+# OAuth tokens from auth.Login / WriteTokens (mode 0600 on disk)
+tokens.json

README.md

@@ -24,7 +24,7 @@ cfg := rh.Config{
 }
 ```
 
-Daemon/headless callers must not call `Login` (no browser). They call `Connect` with an existing token file (mode `0600`).
+Daemon/headless callers must not call `Login` (no browser). They call `Connect` with an existing token file (mode `0600`). Keep `tokens.json` out of git (listed in `.gitignore`).
 
 ## Example