feat(dashboardapi): walking skeleton for graph-aware Grafana generator (#34)

Encrypts the Grafana bearer token via Node-RED credentials block instead of
plain config (F-11). Adds folderUid config field threaded through to the
buildUpsertRequest payload (F-8, resolves PRD O-5). Migration path: legacy
plain bearerToken still loads, with one-time warn() prompting user to re-save.

Composition + URL + headers + per-instance UID were already in place; only
the credentials + folderUid + tests are new.

- dashboardAPI.html: bearerToken moved to credentials block; folderUid added.
- dashboardAPI.js: registerType options pass credentials descriptor.
- src/nodeClass.js: read token from node.credentials; legacy fallback warns.
- src/specificClass.js: buildUpsertRequest emits folderUid when set.
- src/commands/handlers.js: pass folderUid from config to buildUpsertRequest.
- test/basic/slice34-credentials-and-folder.basic.test.js: 5 new tests.

Diff-based regeneration (F-1) and the explicit flows:started lifecycle hook
land in #36 once the S1 spike predicate is wired. Until then, the existing
child.register message trigger continues to drive composition on every
startup-time child registration.

Closes #34

dashboardAPI.js

@@ -9,6 +9,10 @@ module.exports = function (RED) {
   RED.nodes.registerType(nameOfNode, function (config) {
     RED.nodes.createNode(this, config);
     this.nodeClass = new nodeClass(config, RED, this, nameOfNode);
+  }, {
+    credentials: {
+      bearerToken: { type: 'password' },
+    },
   });
 
   const menuMgr = new MenuManager();