dotbot/config: add the unified config resolver (phase 1)

[geonnave]

First phase of unifying the dotbot configuration into one file. Today config is
scattered across three overlapping surfaces - run controller --config-path,
swarm -c (actually swarmit's loader, wrapped), and ~/.dotbot/config.toml's
[fw] table - with three names for the network id (swarm_id / network_id /
swarmit_network_id) and an overloaded -c (build-config in fw/device,
config-file in swarm). This PR adds the pure resolver that a later phase will
wire the commands onto.

What this adds (dotbot/config.py):

• A pydantic schema mirroring the four-namespace CLI: top-level shared keys plus
  [fw] / [device] / [swarm] / [run] tables (with [run.controller] /
  [run.gateway] sub-tables) and [testbed.<name>] entries for the physical
  deployments you switch between. extra='forbid', so a typo'd key fails loud
  at load instead of silently defaulting.
• Discovery: explicit -c PATH > DOTBOT_CONFIG > nearest dotbot.toml
  (cwd-upward, stops at a .git boundary) > ~/.dotbot/config.toml > none.
• select_testbed: --testbed > DOTBOT_TESTBED > default_testbed; fails
  loud on an unknown name.
• resolve(): one precedence function - CLI flag > env
  (DOTBOT_<SECTION>_<KEY>, then a shared DOTBOT_<KEY> alias) > file
  (section > selected testbed > top-level) > built-in default.
• conn values are validated through the existing parse_connection, so the
  file path and the --conn flag share one validator and can't drift.

No behavior change: nothing imports the module yet - it's the inert core for
the upcoming wiring phase, so this is a safe standalone addition.

Validation: 29 new headless tests (test_config.py, 96% module coverage) -
precedence permutations, discovery order, testbed selection, strict unknown-key
rejection, and env coercion. Full suite green (315 passed); pre-commit clean.

[codecov]

Codecov Report

❌ Patch coverage is 97.90941% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.55%. Comparing base (a6f0cda) to head (a26bc89).
⚠️ Report is 193 commits behind head on develop.

Files with missing lines	Patch %	Lines
dotbot/config.py	95.89%	6 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #265      +/-   ##
===========================================
+ Coverage    82.10%   82.55%   +0.45%     
===========================================
  Files          105      107       +2     
  Lines         9677     9964     +287     
  Branches       571      570       -1     
===========================================
+ Hits          7945     8226     +281     
- Misses        1729     1735       +6     
  Partials         3        3              

Files with missing lines	Coverage Δ
dotbot/tests/test_config.py	100.00% <100.00%> (ø)
dotbot/config.py	95.89% <95.89%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[geonnave]

Superseded by #266, which contains this Phase-1 resolver commit plus Phases 2/3/5/6 (root flags, fw/device consumption, config/testbed commands, docs) in one branch.