feat: git credential backend for credential storage (#371)

## Problem

Credentials were stored as plaintext JSON in
`stdpath('data')/cp-nvim.json`, with no integration with system
credential managers.

## Solution

Replace file-based credential storage with `git credential
fill/approve/reject`, delegating to whatever credential helper the user
has configured (`cache`, `store`, `libsecret`, macOS Keychain, etc.).

- New `lua/cp/git_credential.lua` module wrapping the git credential
protocol
- All credential consumers (`credentials.lua`, `submit.lua`,
`scraper.lua`) use `git_credential` directly — `cache.lua` no longer
handles credentials
- CSES API token packed into the password field (`password<TAB>token`)
so it works with helpers that ignore the `path` field
- `has_helper()` guard on `:CP login`, `:CP logout`, and `:CP submit`
with an error message if no helper is configured
- Healthcheck split into `[required]`/`[optional]` sections; git version
and credential helper status shown
- `git` checked at startup in `check_required_runtime()`
- Cache version system (`CACHE_VERSION`, v1→v2 migration) removed — the
cache file is now a plain JSON blob
- `:CP` command gets `bar = true`

lua/cp/submit.lua

@@ -1,8 +1,8 @@
 local M = {}
 
-local cache = require('cp.cache')
 local config = require('cp.config')
 local constants = require('cp.constants')
+local git_credential = require('cp.git_credential')
 local logger = require('cp.log')
 local state = require('cp.state')
 
@@ -14,7 +14,7 @@ local STATUS_MSGS = {
 }
 
 local function prompt_credentials(platform, callback)
-  local saved = cache.get_credentials(platform)
+  local saved = git_credential.get(platform)
   if saved and saved.username and saved.password then
     callback(saved)
     return
@@ -42,6 +42,14 @@ end
 
 ---@param opts { language?: string }?
 function M.submit(opts)
+  if not git_credential.has_helper() then
+    logger.log(
+      'No git credential helper configured. See :help cp-credentials',
+      { level = vim.log.levels.ERROR }
+    )
+    return
+  end
+
   local platform = state.get_platform()
   local contest_id = state.get_contest_id()
   local problem_id = state.get_problem_id()
@@ -109,12 +117,12 @@ function M.submit(opts)
       function(result)
         vim.schedule(function()
           if result and result.success then
-            cache.set_credentials(platform, creds)
+            git_credential.store(platform, creds)
             logger.log('Submitted successfully', { level = vim.log.levels.INFO, override = true })
           else
             local err = result and result.error or 'unknown error'
             if err == 'bad_credentials' or err:match('^Login failed') then
-              cache.clear_credentials(platform)
+              git_credential.reject(platform, creds)
               logger.log(
                 'Submit failed: ' .. (constants.LOGIN_ERRORS[err] or err),
                 { level = vim.log.levels.ERROR }