feat(core): expose read-only config view, generic getter and redacted dump

补齐 Value/String/Bool/Int/Duration/Strings/WasSet/Origin 只读访问器与
按 secret 脱敏的 Entries 导出，新增 core.ConfigGet[T] 泛型读取入口，并用
编译期断言钉住 ConfigRegistry 对 ConfigExtension 的完整实现。

backend/core/config_test.go

@@ -0,0 +1,74 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package core_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"Wavelet/core"
+	"Wavelet/core/extpoints"
+)
+
+// mapSource implements extpoints.ConfigSource over static maps.
+type mapSource struct {
+	values map[string]any
+	env    map[string]string
+}
+
+func (m *mapSource) Lookup(path string) (any, bool) {
+	v, ok := m.values[path]
+	return v, ok
+}
+
+func (m *mapSource) LookupEnv(name string) (string, bool) {
+	v, ok := m.env[name]
+	return v, ok
+}
+
+func (m *mapSource) Describe() string { return "map" }
+
+type otelConfig struct {
+	SamplingRate float64 `config:"sampling_rate" env:"OTEL_SAMPLING_RATE"`
+}
+
+// newOtelRegistry declares the otel section against a source carrying the given file values.
+func newOtelRegistry(t *testing.T, values map[string]any) extpoints.ConfigExtension {
+	t.Helper()
+
+	r := extpoints.NewConfigRegistry(&mapSource{values: values, env: map[string]string{}})
+	require.NoError(t, r.Declare("host", extpoints.ConfigBinding{Prefix: "otel", Target: &otelConfig{}}))
+	require.NoError(t, r.Resolve())
+	return r
+}
+
+func TestConfigGetReturnsDeclaredType(t *testing.T) {
+	view := newOtelRegistry(t, map[string]any{"otel.sampling_rate": 0.25})
+
+	rate, err := core.ConfigGet[float64](view, "otel.sampling_rate")
+	require.NoError(t, err)
+	assert.Equal(t, 0.25, rate)
+}
+
+func TestConfigGetRejectsTypeMismatch(t *testing.T) {
+	view := newOtelRegistry(t, map[string]any{"otel.sampling_rate": 0.25})
+
+	text, err := core.ConfigGet[string](view, "otel.sampling_rate")
+	require.ErrorIs(t, err, extpoints.ErrConfigType)
+	assert.Empty(t, text)
+}
+
+func TestConfigGetRejectsUndeclaredKey(t *testing.T) {
+	view := newOtelRegistry(t, nil)
+
+	_, err := core.ConfigGet[float64](view, "otel.unregistered")
+	require.ErrorIs(t, err, extpoints.ErrConfigUnknownKey)
+}
+
+func TestConfigGetRejectsNilView(t *testing.T) {
+	_, err := core.ConfigGet[float64](nil, "otel.sampling_rate")
+	require.ErrorIs(t, err, extpoints.ErrConfigNotResolved)
+}