feat(maestro): wire maestro-cli to unified config (NAP-233)

CLI now reads `[shared].registry_url` and `[cli].cookie` from the unified
file via maestro-config instead of `~/.config/maestro/cli.toml`. The
two persistence paths are now distinct:

- `maestro set-registry <url>` → writes `[shared].registry_url`
- captured Set-Cookie on first contact → writes `[cli].cookie`

Both go through read-modify-write so they preserve any `[daemon]` /
`[registry]` content already in the file.

Env-var renames on the CLI flag layer:
- `--registry-url` reads `MAESTRO_SHARED_REGISTRY_URL` (was `MAESTRO_REGISTRY_URL`)
- `--config`       reads `MAESTRO_CONFIG`               (was `MAESTRO_CLI_CONFIG`)

Default config path is now `~/.config/maestro/config.toml`.

crates/maestro-cli/src/http.rs

@@ -101,11 +101,7 @@ impl RegistryClient {
         }
         *guard = Some(val.to_string());
         // Persist; on failure, log but don't abort the request.
-        let cfg = CliConfig {
-            registry_url: Some(self.base.clone()),
-            cookie: Some(val.to_string()),
-        };
-        if let Err(e) = cfg.save(&self.config_path) {
+        if let Err(e) = CliConfig::save_cookie(&self.config_path, val) {
             tracing::warn!(error = %e, path = %self.config_path.display(), "failed to persist cookie");
         }
         Ok(())