Add subfolder sync mode, session token persistence, improved retry and glob handling

[asmotim]

Motivation

• Allow syncing a vault into a remote repository subfolder (useful for monorepos) without changing existing default behavior.
• Improve secret handling by making the token session-only by default and providing an explicit "Persist token on disk" setting.
• Harden GitHub API interactions with header-aware retry/backoff and clearer handling of rate-limit and Retry-After semantics.
• Reduce third-party dependency footprint and add robust glob/globstar support for ignore patterns.

Description

• Added new settings and types for repository scope and token persistence: repoScopeMode, repoSubfolder, and persistToken, and introduced sanitizeSettingsForPersistence to avoid persisting the token unless enabled.
• Updated the settings UI to expose a password-style token input, a Persist token on disk toggle, and Repository scope + Repository subfolder controls.
• Implemented repository-subfolder support across engine/indexers/conflict runner: remote paths are now mapped with toRemotePath/stripSubfolder and fetch/index APIs accept an optional repoSubfolder.
• Enhanced GitHubApiClient retry logic to inspect response headers (x-ratelimit-remaining, retry-after, x-ratelimit-reset) and compute backoff delays accordingly, and added a case to avoid retries for non-rate-limit 403 responses.
• Replaced picomatch usage with an internal glob-to-RegExp implementation that supports *, ?, and ** (globstar), and simplified local indexer ignore logging and large-file warnings.
• Documentation and README updated with repository scope modes, token persistence notes, and testing instructions; CI release workflow tag filter tightened to SemVer (*.*.*).
• Removed picomatch and related type devDependency from package.json, adjusted package-lock.json, and updated many tests to cover the new behaviors.

Testing

• Ran unit and integration tests with npm test (Vitest) covering conflict-action-runner, github-client, local-indexer, remote-indexer, sync-engine, and new plugin-settings tests, and all tests passed.
• Exercised header-based retry scenarios and non-retry 403 behavior via github-client tests which succeeded.
• Verified ignore-pattern behavior including ** globstar via local-indexer tests which succeeded.

---

Codex Task