Add macOS Keychain fallback for 1Password service account token

[Copilot]

Today the server expects OP_SERVICE_ACCOUNT_TOKEN to be present directly in MCP client config or process env, which leaves a plaintext credential in a predictable local config file for common setups. This change adds a native macOS Keychain lookup path so the server can start without embedding the token in config.

• Config resolution

  • Adds macOS-only Keychain lookup when OP_SERVICE_ACCOUNT_TOKEN is absent.
  • Supports:
    • OP_KEYCHAIN_SERVICE — required to identify the Keychain item
    • OP_KEYCHAIN_ACCOUNT — optional account filter for disambiguation
  • Keeps precedence explicit and unchanged for existing users:
    1. --service-account-token / --token
    2. OP_SERVICE_ACCOUNT_TOKEN
    3. macOS Keychain lookup

• Server behavior

  • Resolves the token via the security find-generic-password CLI on darwin only.
  • Extends tokenSource reporting to include keychain.
  • Updates the missing-token error message to mention the new Keychain path.

• Docs and metadata

  • Documents the new macOS env vars and precedence in README.md.
  • Adds a JSON config example for Keychain-backed startup.
  • Updates server.json so OP_SERVICE_ACCOUNT_TOKEN is no longer described as the only required path.

• Example

  {
    "mcpServers": {
      "1password": {
        "command": "npx",
        "args": ["-y", "@takescake/1password-mcp"],
        "env": {
          "OP_KEYCHAIN_SERVICE": "op-service-account-claude-automation",
          "OP_KEYCHAIN_ACCOUNT": "your-macos-username"
        }
      }
    }
  }

  With this configuration, the server reads the token from macOS Keychain at startup instead of requiring a plaintext OP_SERVICE_ACCOUNT_TOKEN in the MCP config.