Migrate Matrix auth to appservice (MAS-durable)

Replace password login + password-UIA cross-signing with appservice
as_token auth and MSC4190 device creation, so the bot survives the
Matrix Authentication Service (MAS) migration that removes m.login.password
and UIA.

- internal/bot/client.go: NewClient uses AS_TOKEN, SetAppServiceUserID,
  whoami validation, cryptohelper MSC4190 device create; drop device.json
  (crypto store persists device id); cross-signing best-effort/soft-fail.
- main.go: Config.Password -> ASToken (reads AS_TOKEN).
- internal/util/auth.go: deleted (password login dead in a MAS world).
- Bump mautrix-go v0.28.0 -> v0.28.1.
- registration.yaml.example + README/.env.example: appservice setup docs.

main.go

@@ -59,7 +59,7 @@ func main() {
 	cfg := bot.Config{
 		Homeserver:  os.Getenv("HOMESERVER_URL"),
 		UserID:      os.Getenv("BOT_USER_ID"),
-		Password:    os.Getenv("BOT_PASSWORD"),
+		ASToken:     os.Getenv("AS_TOKEN"),
 		DataDir:     dataDir,
 		DisplayName: envOr("BOT_DISPLAY_NAME", "GogoBee"),
 	}