Problem

When using environment variables for API keys (e.g., ${ANTHROPIC_API_KEY} in config),
clawdbot still auto-syncs credentials from Claude Code CLI to auth-profiles.json on
every startup.

For users implementing "zero secrets at rest" (all credentials in external secret
managers like 1Password, HashiCorp Vault, etc.), this creates an unwanted copy of
credentials on disk that cannot be disabled.

Current Behavior

syncExternalCliCredentials() runs unconditionally in store.js:158-163:

const synced = syncExternalCliCredentials(asStore);
if (synced) {
    saveJsonFile(authPath, asStore);
}

Requested Feature

Add a config option to disable external CLI sync:

{
  "auth": {
    "syncExternalCli": false
  }
}

When false:

• Skip syncExternalCliCredentials() entirely
• Do not read from ~/.claude/.credentials.json or Keychain
• Users who want this behavior can still use env vars or direct API keys

Use Case

Security-conscious deployments where:

• All secrets managed externally (1Password, Vault, etc.)
• Secrets injected as env vars at runtime
• No plaintext credentials should exist on disk
• Defense in depth: even if file perms are 0600, prefer no secrets at all