Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents | CodexMaster