Add credential extraction registry for generate

Protocols like Xiaomi need credentials (tokens) in a separate top-level
YAML section, not in the stream URL itself. Introduce a registry pattern
mirroring streams.HandleFunc / tester.RegisterSource:

- pkg/generate/registry.go: ExtractFunc + RegisterExtract
- Extractors clean the URL (strip ?token=...) and return section/key/value
- writeCredentials emits sorted sections between go2rtc: and cameras:
- upsertCredentials in addToConfig merges into existing sections:
  * replaces value if key exists (token refresh)
  * inserts in sorted order if new
  * creates new top-level section before cameras: if missing

Xiaomi registers its extractor from internal/xiaomi/xiaomi.go. Adding
Tapo/Ring/Roborock later is one line + a small function in their
internal/*/ module -- zero changes in pkg/generate/.

pkg/generate/registry.go

@@ -0,0 +1,24 @@
+package generate
+
+import "strings"
+
+// ExtractFunc cleans rawURL (ex. strips ?token=...) and returns a top-level
+// YAML section name + key/value to upsert into the config.
+// Returns empty section if the URL has nothing to extract -- cleaned URL
+// is still used as-is.
+type ExtractFunc func(rawURL string) (cleaned, section, key, value string)
+
+var extractors = map[string]ExtractFunc{}
+
+func RegisterExtract(scheme string, fn ExtractFunc) {
+	extractors[scheme] = fn
+}
+
+func runExtract(rawURL string) (cleaned, section, key, value string) {
+	if i := strings.IndexByte(rawURL, ':'); i > 0 {
+		if fn := extractors[rawURL[:i]]; fn != nil {
+			return fn(rawURL)
+		}
+	}
+	return rawURL, "", "", ""
+}