Migrate Matrix auth to appservice (MAS-durable)

Replace password login + password-UIA cross-signing with appservice
as_token auth and MSC4190 device creation, so the bot survives the
Matrix Authentication Service (MAS) migration that removes m.login.password
and UIA.

- internal/bot/client.go: NewClient uses AS_TOKEN, SetAppServiceUserID,
  whoami validation, cryptohelper MSC4190 device create; drop device.json
  (crypto store persists device id); cross-signing best-effort/soft-fail.
- main.go: Config.Password -> ASToken (reads AS_TOKEN).
- internal/util/auth.go: deleted (password login dead in a MAS world).
- Bump mautrix-go v0.28.0 -> v0.28.1.
- registration.yaml.example + README/.env.example: appservice setup docs.

.env.example

@@ -1,7 +1,11 @@
 # ---- Matrix Connection ----
+# GogoBee authenticates as an appservice (MAS-durable). AS_TOKEN is the
+# as_token from registration.yaml — a Synapse-level credential that never
+# expires and is unaffected by Matrix Authentication Service. See
+# registration.yaml.example for the homeserver-side setup.
 HOMESERVER_URL=https://matrix.example.com
 BOT_USER_ID=@gogobee:example.com
-BOT_PASSWORD=your_password_here
+AS_TOKEN=your_appservice_as_token_here
 BOT_DISPLAY_NAME=GogoBee
 
 # Which rooms the bot posts scheduled content to (comma-separated room IDs)