Clean up credential source fallbacks

[shanselman]

Summary

• Remove the legacy settings Token/BootstrapToken fallback from interactive chat/dashboard credential resolution; these flows now resolve from the active GatewayRegistry record plus per-gateway identity only.
• Keep one-time legacy migration intact and retain the legacy root identity startup backstop with a warning for failed/old migrations.
• Tighten local gateway setup credential persistence so setup credentials merge through GatewayRegistry, preserve existing record metadata, and explicit clears remove registry tokens instead of preserving stale values.
• Add regression coverage for active-registry credential resolution and local setup registry-only credential persistence/clear behavior.

Validation

• ./build.ps1
• dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore
• dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore
• dotnet test ./tests/OpenClaw.Connection.Tests/OpenClaw.Connection.Tests.csproj --no-restore