[Suggestion] /model-usage config dialog with secure secrets storage #12

Is your feature request related to a problem? Please describe.
The plugin requires users to set environment variables manually (GITHUB_TOKEN, OPENCODE_GO_WORKSPACE_ID, OPENCODE_GO_AUTH_COOKIE, OPENCODE_GO_API_KEY). There is no in-app way to configure them, and tokens end up in shell env/shell history.

Describe the solution you'd like
A configuration flow inside opencode:

1. New slash command /model-usage config:
   • Shows the list of settings with set/unset status (masked values)
   • Pick a field (DialogSelect), enter the value (DialogPrompt — available on TuiPluginApi.ui), save
2. Storage with fallback chain (per user decision):
   • macOS Keychain via security CLI (primary) — real OS encryption, no dependencies; wlib-style cross-platform native-command pattern
   • Encrypted file (AES-256-GCM) via node crypto as first fallback (encrypted at rest with a local key)
   • Plain JSON as final fallback
3. Reading side merges env → store: getGoAuth()/quota fetch and sidebar token lookup (model-usage/quota.ts, model-usage/sidebar.tsx:300) check env first, then the secrets store — existing env-based users keep working unchanged
4. Expose the store as a reusable module (candidate for opencode-wlib secrets module)

Describe alternatives you've considered

• Encrypted SQLite via bun:sqlite — rejected: bun:sqlite has no SQLCipher support without native builds
• Writing back into opencode's own auth.json — rejected: out of scope, risky, plugin keeps its own store

Additional context
⚠️ Note: the OpenCode TUI dialog API is in flux — verify api.ui.DialogPrompt renders correctly inside a plugin-owned dialog at implementation time; if not, fall back to a dialog with copy-paste instructions.

Media
N/A