feat(config): add puppy_token provider hook for plugin-based credential backends

[GregKinne]

Summary

Adds register_puppy_token_provider(getter, setter) to config.py so
distribution-specific plugins can route puppy_token storage through a
secure backend (e.g. OS keyring) without modifying core code.

Motivation

Downstream enterprise distributions need to migrate puppy_token from
plaintext puppy.cfg into the OS keyring. Today, that requires editing
the core get_puppy_token / set_puppy_token functions directly,
which creates merge conflicts and mixes organization-specific logic into
the open-source core.

This hook lets the plugin layer own the credential backend entirely.

Changes

config.py (+26 lines)

• register_puppy_token_provider(*, getter, setter) — registers custom
  get/set functions for the puppy_token credential
• get_puppy_token() — delegates to registered provider, falls back to
  get_value('puppy_token') when none is registered
• set_puppy_token() — same pattern

Zero breaking changes. When no provider is registered (the default),
behavior is identical to the current code.

tests/test_config_and_storage_edge_cases.py (+40 lines)

Three new tests:

• Provider getter delegation
• Provider setter delegation
• Plaintext fallback when no provider is registered

Usage (downstream plugin example)

# In a plugin's register_callbacks.py:
from code_puppy.config import register_puppy_token_provider

def my_get():
    return keyring.get_password('my-service', 'puppy_token')

def my_set(token):
    keyring.set_password('my-service', 'puppy_token', token)

register_callback('startup', lambda: register_puppy_token_provider(
    getter=my_get, setter=my_set,
))