Deprecate tokenDir in favor of the per-user env file

[defangdevs]

From Lio's review of PR 92 (#92 (comment)): "I think tokenDir is completely superseded by per-user env."

Agreed — tokenDir (/etc/agent-box/<user>.env, root-owned 0600) predates both the self-serve settings page (issue 36) and the spawn-time env wrapper (issue 89). The per-user ~/.config/agent-box/env now covers the same use case with strictly better properties: self-serve through the browser (no root shell needed), applied on every session spawn (add-session, per-session restart, crash respawn) instead of only on a unit bounce, and never typed into the agent chat.

Removing tokenDir would delete the tmpfiles rules, the unit EnvironmentFile= wiring and its rename-migration path, and the "root drops need a unit restart" caveat that survived PR 92.

Sketch:

• One-shot migration on activation (root can read both sides): append any existing /etc/agent-box/<user>.env entries into ~/.config/agent-box/env (user-owned 0600, keep existing keys' precedence), then remove the old file.
• Drop tokenDir / manageTokenDir options — or keep them one release as deprecated no-ops with a warning, since deployed boxes self-update against this module.
• cfg.environmentFiles / users.<name>.environmentFiles (host-declared extra files) are unaffected.

[lionello]

No users of tokenDir, so no need for migration.

[defangdevs]

Per Lio: nixos.defang.ca is likely the only tokenDir user and gets a one-time manual migration instead — tracked as defangdevs/nixos-defang-ca#14 (claude side verified already covered by the user env file; only the possible codex.env needs the root one-liner there). So this issue can remove tokenDir/manageTokenDir with no migration code.

[defangdevs]

Done in #153 — went further than deprecation: tokenDir/manageTokenDir removed outright (no deployed boxes relied on it), per-user ~/.config/agent-box/env + agent-box-session env set is the single mechanism now.