feat(core): expose read-only config view, generic getter and redacted dump

补齐 Value/String/Bool/Int/Duration/Strings/WasSet/Origin 只读访问器与
按 secret 脱敏的 Entries 导出，新增 core.ConfigGet[T] 泛型读取入口，并用
编译期断言钉住 ConfigRegistry 对 ConfigExtension 的完整实现。

backend/core/extpoints/config.go

@@ -45,9 +45,16 @@ const (
 	OriginDefault = "default"
 )
 
+// RedactedValue replaces the printed value of keys declared with secret:"true".
+const RedactedValue = "******"
+
 // durationType distinguishes time.Duration from plain int64 during tag walking and decoding.
 var durationType = reflect.TypeFor[time.Duration]()
 
+// ConfigRegistry must satisfy the full extension contract, so a missing accessor is a
+// compile error rather than a runtime surprise inside a plugin Apply.
+var _ ConfigExtension = (*ConfigRegistry)(nil)
+
 // ConfigSource abstracts where raw configuration values come from, keeping the
 // micro-kernel free of concrete loaders such as viper.
 type ConfigSource interface {