feat(dashboardapi): walking skeleton for graph-aware Grafana generator (#34)

Encrypts the Grafana bearer token via Node-RED credentials block instead of
plain config (F-11). Adds folderUid config field threaded through to the
buildUpsertRequest payload (F-8, resolves PRD O-5). Migration path: legacy
plain bearerToken still loads, with one-time warn() prompting user to re-save.

Composition + URL + headers + per-instance UID were already in place; only
the credentials + folderUid + tests are new.

- dashboardAPI.html: bearerToken moved to credentials block; folderUid added.
- dashboardAPI.js: registerType options pass credentials descriptor.
- src/nodeClass.js: read token from node.credentials; legacy fallback warns.
- src/specificClass.js: buildUpsertRequest emits folderUid when set.
- src/commands/handlers.js: pass folderUid from config to buildUpsertRequest.
- test/basic/slice34-credentials-and-folder.basic.test.js: 5 new tests.

Diff-based regeneration (F-1) and the explicit flows:started lifecycle hook
land in #36 once the S1 spike predicate is wired. Until then, the existing
child.register message trigger continues to drive composition on every
startup-time child registration.

Closes #34

dashboardAPI.html

@@ -13,9 +13,12 @@
       protocol: { value: 'http' },
       host: { value: 'localhost' },
       port: { value: 3000 },
-      bearerToken: { value: '' },
+      folderUid: { value: '' },
       defaultBucket: { value: '' },
     },
+    credentials: {
+      bearerToken: { type: 'password' },
+    },
     inputs: 1,
     outputs: 1,
     inputLabels: ['Input'],
@@ -44,11 +47,12 @@
         window.EVOLV.nodes.dashboardapi.loggerMenu.saveEditor(node);
       }
 
-      ['name', 'protocol', 'host', 'port', 'bearerToken', 'defaultBucket'].forEach((field) => {
+      ['name', 'protocol', 'host', 'port', 'folderUid', 'defaultBucket'].forEach((field) => {
         const element = document.getElementById(`node-input-${field}`);
         if (!element) return;
         node[field] = field === 'port' ? parseInt(element.value, 10) || 3000 : element.value || '';
       });
+      // bearerToken is handled by Node-RED's credentials system (encrypted at rest in flow_cred.json).
     },
   });
 </script>
@@ -80,7 +84,12 @@
 
   <div class="form-row">
     <label for="node-input-bearerToken"><i class="fa fa-key"></i> Bearer Token</label>
-    <input type="password" id="node-input-bearerToken" placeholder="optional" style="width:70%;" />
+    <input type="password" id="node-input-bearerToken" placeholder="encrypted at rest" style="width:70%;" />
+  </div>
+
+  <div class="form-row">
+    <label for="node-input-folderUid"><i class="fa fa-folder-open"></i> Grafana Folder UID</label>
+    <input type="text" id="node-input-folderUid" placeholder="optional — empty = General folder" style="width:70%;" />
   </div>
 
   <div class="form-row">