feat(setup): validate onecli api token starts with oc_

Matches the OneCLI CLI's own format expectation ("oc_... format" per
`onecli auth login --help`) so a malformed token gets caught at setup
time rather than at first vault call.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

setup/lib/setup-config.ts

@@ -82,7 +82,8 @@ export const CONFIG: Entry[] = [
     group: 'OneCLI',
     type: 'string',
     secret: true,
-    placeholder: 'oat_…',
+    placeholder: 'oc_…',
+    validate: (v) => (v.startsWith('oc_') ? undefined : 'Must start with oc_'),
   },
   {
     key: 'anthropicBaseUrl',