Add token auto-refresh, device persistence, and cross-signing

Following gogobee's auth pattern: if MATRIX_BOT_PASSWORD is set, the bot
persists device credentials to device.json, validates tokens on startup,
re-logs in automatically when tokens expire, and bootstraps cross-signing
so the device shows as verified without manual emoji verification.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/preflight/preflight.go

@@ -59,7 +59,11 @@ func PrintResults(results []Result) bool {
 }
 
 func checkMatrix(cfg *config.Config) Result {
-	client, err := matrix.New(cfg.MatrixHomeserverURL, cfg.MatrixBotUserID, cfg.MatrixBotAccessToken, "")
+	client, err := matrix.New(matrix.ClientConfig{
+		HomeserverURL: cfg.MatrixHomeserverURL,
+		UserID:        cfg.MatrixBotUserID,
+		AccessToken:   cfg.MatrixBotAccessToken,
+	})
 	if err != nil {
 		return Result{"Matrix", "fail", fmt.Sprintf("client error: %v", err)}
 	}