refactor(config): split config.rs into storage, auth and dashboard modules

[BryanFRD]

Closes #564

config.rs goes from 732 to 256 lines:

• config/storage.rs: Storage, Dialect, the Azure and GCS credentials, DiskCache, KeySource and their parsing.
• config/auth.rs: Auth, Provider, GithubApp, the cache and budget defaults and their parsing.
• config/dashboard.rs: Dashboard and its parsing.
• config.rs keeps Config, Config::from_env, the URL helpers and the generic readers (bytes, seconds, transfer_cap, compression).

A pure move. Every line of the old file is in the new ones except for visibility (pub(super) on what the parent and the tests call) and imports, which I checked by comparing the two sets of lines. The public API is unchanged: every type is re-exported from config, so lfsx_server::config::* resolves as before. The config tests only gained explicit imports; 37 pass, as do the full workspace suite and clippy.

[ferrfleet]

Pure move, checked against the removed hunks: behaviour, panic messages and comments are unchanged. Visibility holds up: seconds stays private in the parent and is reachable from auth, forges imports from super::auth, the re-exports keep the public config::* paths, and tests import the pub(super) helpers explicitly. CI Check was still running when I looked.

Nit: several helpers (provider, api_url, lookup_budget, is_set, LOOKUP_BUDGET, DASHBOARD_DIR, gcs_credential, azure_credential) are now pub(super) only so config/tests.rs can reach them. A #[cfg(test)] mod tests; per submodule, the way forges already has one, would keep them private. Not blocking.

[ferrfleet]

Nit: the move dropped the blank line between this const and the anonymous_read comment, so the comment now reads as if it belonged to the constant.

Suggested change

	// Opt in, not opt out. Serving objects to a caller with no credentials at all is
	pub(super) const LOOKUP_BUDGET: u32 = 600;