Store auth token as appdata / inside homedir

[bede]

Will remove need to specify --token /path/to/token.json

Will make more sense once we're silently refreshing tokens with every API request, which will mean overwriting token.json often

Decide where these should live using something like

• https://github.com/srstevenson/xdg
• https://github.com/platformdirs/platformdirs

[bede]

Or appdirs (@lmmx)