feat: implement AWS temporary session based interactions

Start with the Alias struct in crates/core and read AGENTS.md for the breaking-change process. Trace S3Client, AdminClient, the CLI alias set entry point, migrations/, and schemas/output_v2.json, then inspect the golden tests. Done means session-token configuration, expiry handling, redaction, migration, schema updates, and the listed cargo checks all pass.

Description

Implement support for AWS session tokens to enable temporary, role-based interactions with S3-compatible backends. To maintain a seamless user experience, aliases utilizing expired session tokens will be automatically pruned from the configuration upon detection.

Requirements

• Core Alias Updates: Update the Alias configuration to support an optional session token using #[serde(default)] for backward compatibility.
• Security: Implement a custom fmt::Debug for the Alias struct to ensure session tokens and secret keys are scrubbed from logs.
• Credential Injection: Modify S3Client and AdminClient to inject the session token into the AWS credentials provider.
• Error Handling: Introduce a TokenExpired(String) error variant and map AWS ExpiredToken / InvalidToken errors to it.
• CLI Auto-Pruning: Intercept TokenExpired errors at the CLI boundary to log a clear message, automatically remove the dead alias from config.toml, and exit gracefully.

Acceptance Criteria

• rc alias set supports a new --session-token flag.
• Configuration changes include a schema_version bump and a migration path (migrations/).
• schemas/output_v2.json is updated to include the session_token field in the aliasInfo definition.
• Static credentials continue to function normally when the session token is omitted.
• CLI correctly identifies an expired token, logs a helpful warning, deletes the alias, and exits with AUTH_ERROR (Code 4).
• Debug/verbose logs strictly mask the session token as ***REDACTED***.
• Golden tests are successfully regenerated (UPDATE_GOLDEN=1 cargo test --features golden) and pass.
• Pre-commit checks (cargo fmt --all, cargo clippy --workspace -- -D warnings) pass with zero warnings.

Notes

This change impacts the Alias struct in crates/core, triggering the Breaking Change process outlined in AGENTS.md. The aws-sigv4 crate automatically handles the X-Amz-Security-Token header during request signing.