Migrates to forge v0.12.0, whose ProviderFactory takes an Endpoint rather
than a ReleaseSourceConfig. Settings.ReleaseSource becomes
Settings.Endpoint, and the Enterprise URL derivation and device-flow host
read Endpoint.Host.

SettingsFromConfig now takes the ROOT configuration rather than a
pre-scoped subtree, and resolves its own section from the endpoint. That
is the substantive half of the change rather than a rename: which subtree
a source reads is part of what its endpoint means, so an unnamed endpoint
reads `github` and a named one reads `github.<name>`. Two GitHub sources —
two credentials, or an Enterprise instance beside github.com — therefore
stop sharing one set of keys, which is what the Endpoint cut exists for.

A named source that has no subtree of its own reads nothing rather than
inheriting the default source's, and there is a test pinning that. Falling
back would be the same silent-sharing bug in a friendlier disguise: a
source would appear configured while using a credential nobody pointed at
it.

Endpoint.Type is defaulted here when empty, because the package already
knows which provider it is and Section cannot resolve a subtree without
one — reading nothing silently is the failure this change removes.

Implements forge spec 0008 D1 and D2 for this adapter.

The type selects the configuration subtree, so a caller handing this
factory another provider's type would make this provider read that
provider's configuration — including its credential. The registry already
knows which implementation was selected, because the caller reached this
factory by that source type, so the factory sets it rather than trusting
or defaulting it.

Latent here, where the module registers one type. The sibling gitea module
proved it is not theoretical: it serves two, and letting the type default
downstream sent a Codeberg lookup to gitea's section — the exact
cross-authentication its spec 0001 settled.