Mint and print a token from key + secret (conductor auth token)

Add a command that exchanges the configured key and secret for a token and prints it to stdout, so it can be captured:

```bash
export CONDUCTOR_AUTH_TOKEN=$(conductor auth token)
```

`aws ecr get-login-password` and `gcloud auth print-access-token` exist for exactly this.

## Today

No command prints a minted token. `whoami` mints one at `cmd/whoami.go:41`, reads the claims, and discards it. So the fetch already exists — `conductor auth token` or `whoami --token` is mostly plumbing.

## Also worth deciding

With key, secret and token all set, the token wins (`cmd/root.go:164`). If it has expired the command fails instead of falling back to the key and secret. That rule is only a code comment.

Found while reviewing #113.

Start with the token-fetching path in cmd/whoami.go:41 and the credential precedence described in cmd/root.go:164. Trace how the configured key and secret produce a token, then expose that result through the auth token command. Done means conductor auth token prints the minted token to stdout so shell capture works; clarify the expired-token behavior before changing that rule.

Written by the indexing model from the issue text.