Add token auto-refresh, device persistence, and cross-signing

Following gogobee's auth pattern: if MATRIX_BOT_PASSWORD is set, the bot
persists device credentials to device.json, validates tokens on startup,
re-logs in automatically when tokens expire, and bootstraps cross-signing
so the device shows as verified without manual emoji verification.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/config/config.go

@@ -13,6 +13,7 @@ type Config struct {
 	MatrixHomeserverURL  string
 	MatrixBotUserID      string
 	MatrixBotAccessToken string
+	MatrixBotPassword    string
 	MatrixDealsRoomID    string
 	ITADAPIKey           string
 	DealSources          []string
@@ -42,6 +43,8 @@ func Load() (*Config, error) {
 	if err != nil {
 		return nil, err
 	}
+	c.MatrixBotPassword = os.Getenv("MATRIX_BOT_PASSWORD")
+
 	c.MatrixDealsRoomID, err = require("MATRIX_DEALS_ROOM_ID")
 	if err != nil {
 		return nil, err