Give users one place to keep their UN API key

[marcelolafleur]

Anyone can now generate their own API token straight from the data portal — there's a Generate Token button on https://population.un.org/dataportalapi/index.html. It used to mean emailing the Population Division and waiting for a reply.

So getting a key is no longer the hard part. Keeping it is.

Right now the key lives in a file in whatever directory you happen to run from. Every repo ends up with its own copy, and in practice every folder inside it too. Keeping them all current is a chore, so most of us skip the key and let the model fall back to the Population-Data mirror.

That fallback works and should stay. But it means the live UN path barely gets used, and anyone who does set up a key ends up maintaining several copies of it.

The cause is that get_un_data looks for un_api_token.txt in the current working directory, and writes one there if it doesn't find one. On my machine that's 20 of these files holding 4 different keys. A few have ended up in folders that get zipped and sent to people.

Suggested fix — one key per user, set once, works from any repo. Look in this order, first hit wins:

1. un_token= argument
2. UN_API_TOKEN environment variable
3. one file in the user's config directory
4. un_api_token.txt in the working directory — still works, warns

Add an og-token command so people can manage it without hunting for the file:

og-token set    # asks once, saves to the config file
og-token show   # prints where it lives and the last 4 characters
og-token rm

The prompt stays — it's how people find out they need a key. It just saves to the config file now instead of the folder you're standing in.

Nothing changes about the mirror fallback.

Happy to do the PR. Two things worth settling first:

• og-token would be OG-Core's first console script. Any objection to adding [project.scripts]?
• Config path via platformdirs (already in the lock)? On macOS that's ~/Library/Application Support/og rather than ~/.config/og — fine either way, og-token show prints it.

cc: @rickecon @jdebacker