Add datasources & passtrough

[tino097]

Add datasource vault with credential injection and output scrubbing
Introduces a full datasource connection system for Anton — users can connect databases and APIs, credentials are stored in a local vault, and the LLM works with them safely.

• Local Vault (data_vault.py) — stores credentials as JSON in ~/.anton/data_vault/,
• Datasource Registry (datasource_registry.py, datasources.md) — built-in definitions for PostgreSQL, HubSpot, and others supports custom engines via ~/.anton/datasources.md
• Credential injection — at session startup, all vault connections are injected as DS_* env vars so scratchpad subprocesses inherit them without reading vault files directly. Cleared after session ends or connected to another datasource.
• Output scrubbing — before any scratchpad result reaches the LLM, secret DS_* values are replaced with their placeholder name (e.g. [DS_PASSWORD]). Driven by DatasourceField.secret from the registry definition, not a static allowlist
• Slash commands — /connect-data-source, /list-data-sources, /remove-data-source wired into the chat REPL and anton connect-datasource CLI command

EDIT:

• This PR contains onboarding-launch changes