feat(studio): registry credentials panel in Settings (v0.44.0)

The hub install path now reads `~/.fai/registry-token` as a
fallback when `FAI_REGISTRY_TOKEN` is unset (platform v0.10.92).
Studio now writes that file directly: a fresh operator pastes
the PAT into Settings → Registry credentials, hits Save, and
the next install attempt resolves the auth wall without any
shell or env-var setup.

The token never round-trips back into Studio after save —
status is shown only as "Configured (40 chars)" / "Not set"
with no display of the secret itself. The Clear action deletes
the file. On Unix the file is chmod-ed to 0600 (owner-only
read/write); Windows leaves the default user ACL in place.

Storage is strictly local: `~/.fai/registry-token`, never sent
to a remote service. The hint text under the field says so to
make the data flow explicit.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_localizations_de.dart

@@ -1117,6 +1117,48 @@ class AppLocalizationsDe extends AppLocalizations {
     return 'Konnte Datei nicht öffnen: $error';
   }
 
+  @override
+  String get registryCredentialsHeader => 'REGISTRY-ZUGANGSDATEN';
+
+  @override
+  String get registryCredentialsBlurb =>
+      'Token zum Herunterladen von .fai-Modulen aus einer Registry mit Anmeldepflicht (Forgejo, private GitHub-Repos). Gespeichert in ~/.fai/registry-token, Modus 0600. Die Umgebungsvariable FAI_REGISTRY_TOKEN hat weiterhin Vorrang, wenn gesetzt.';
+
+  @override
+  String registryTokenStatusConfigured(int chars) {
+    return 'Konfiguriert ($chars Zeichen)';
+  }
+
+  @override
+  String get registryTokenStatusNotSet => 'Nicht gesetzt';
+
+  @override
+  String get registryTokenFieldLabel => 'Token';
+
+  @override
+  String get registryTokenFieldHint => 'Forgejo- oder GitHub-PAT einfügen';
+
+  @override
+  String get registryTokenSaveButton => 'Speichern';
+
+  @override
+  String get registryTokenClearButton => 'Entfernen';
+
+  @override
+  String get registryTokenStorageHint =>
+      'Lokal gespeichert in ~/.fai/registry-token. Wird nie an einen Remote-Dienst übertragen.';
+
+  @override
+  String get registryTokenSavedToast => 'Registry-Token gespeichert.';
+
+  @override
+  String get registryTokenClearedToast => 'Registry-Token entfernt.';
+
+  @override
+  String registryTokenSaveFailedToast(String error) {
+    return 'Speichern fehlgeschlagen: $error';
+  }
+
   @override
   String get welcomeChecklistAllSetTitle => 'Du bist eingerichtet.';