fix(auth): report config file path as token source

[akasakariko]

Fixes #94.

When a token comes from configuration, TokenForHost and TokenFromEnvOrConfig currently report the literal oauth_token as its source. Return the hosts.yml path using the existing config.ConfigDir() resolution so callers can identify the configuration file. Token lookup precedence and keyring fallback are preserved.

Update the configured-host expectations and cover GH_CONFIG_DIR precedence, the XDG_CONFIG_HOME fallback, paths containing spaces, and both public lookup functions. Tests use in-memory configuration and fake tokens.

Validation on macOS/arm64 with Go 1.25.0:

• Seven regression cases fail against the old implementation and pass with the fix.
• go test ./pkg/auth -count=1: passed.
• go test -v ./...: 21 packages passed; two packages have no tests.
• golangci-lint v2.6.0: zero issues.
• gofmt -l, go mod tidy -diff, and git diff --check: clean.