Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails (#35094)

src/commands/onboard-types.ts

@@ -144,6 +144,7 @@ export type OnboardOptions = {
   gatewayBind?: GatewayBind;
   gatewayAuth?: GatewayAuthChoice;
   gatewayToken?: string;
+  gatewayTokenRefEnv?: string;
   gatewayPassword?: string;
   tailscale?: TailscaleMode;
   tailscaleResetOnExit?: boolean;