refactor(config): make config updates non-destructive

[jonas1307]

What changed

Configuration updates are now non-destructive. Previously SaveConfig rebuilt the whole config from the provided options, so any partial update would wipe the fields that were not passed (for example, changing the URL would drop the stored token). It now merges into the existing configuration, matching the sibling devops-cli.

ConfigService

• SaveConfig merges: only values actually supplied overwrite the stored ones (opts.X ?? existing.X).
• Extracted a private WriteConfig(Config) that owns token encryption, making the pair symmetric: LoadConfig decrypts, WriteConfig re-encrypts (guarded against an empty token).
• Removed the SetTableBorder workaround that existed only because the previous save was destructive. GetTableBorder stays, since table rendering reads the border without needing to decrypt the token.

ConfigValidator

• Credentials are required only on first-time setup; once configured, any single option can be updated on its own.
• The URL is validated as HTTPS whenever it is supplied (not just during initial setup).
• Requires at least one option, and keeps the border value validation.

Config command

• Re-authenticates and re-seeds the activity cache only when --url or --token are supplied. Other updates (such as --border) merge locally with no network call.
• When authenticating, it uses the effective credentials — newly supplied values fall back to the stored ones — so rotating just the token keeps the existing URL.

Verification

Validated locally end to end: partial updates preserve credentials, a follow-up authenticated request still succeeds (confirming the token survives the encrypt/decrypt round trip), token rotation keeps the URL, and the error paths behave (missing options, invalid border, non-HTTPS URL).