Fix multi-profile token leakage fallback bug (#337)

This commit modifies `AuthManager.getToken()` to strictly return the chosen profile's token or `null` if the profile has no token, removing the previous logic that incorrectly fell back to the global token (`KEY_TOKEN`).

Why this was necessary:
Before this change, if a user switched to a profile that lacked a saved token (Profile B), the system would fall back to the global token, effectively leaking Profile A's credentials to Profile B's configured host. This was an unintended and critical cross-profile authentication leak.

Impact:
This ensures strong isolation between user profiles. If a profile doesn't have its own credentials, the system will correctly register it as unauthenticated rather than trying to reuse potentially sensitive global tokens.
Unit tests have also been updated to ensure the fallback logic is tested as strictly returning `null`.

Fixes #258

app/src/main/java/com/m57/hermescontrol/data/local/AuthManager.kt

@@ -147,8 +147,7 @@ object AuthManager {
     fun getToken(): String? {
         val selectedId = getSelectedProfileId()
         if (selectedId != null) {
-            val token = getProfileToken(selectedId)
-            if (token != null) return token
+            return getProfileToken(selectedId)
         }
         return requirePrefs().getString(KEY_TOKEN, null)
     }