feat(dashboardapi): walking skeleton for graph-aware Grafana generator (#34)

Encrypts the Grafana bearer token via Node-RED credentials block instead of
plain config (F-11). Adds folderUid config field threaded through to the
buildUpsertRequest payload (F-8, resolves PRD O-5). Migration path: legacy
plain bearerToken still loads, with one-time warn() prompting user to re-save.

Composition + URL + headers + per-instance UID were already in place; only
the credentials + folderUid + tests are new.

- dashboardAPI.html: bearerToken moved to credentials block; folderUid added.
- dashboardAPI.js: registerType options pass credentials descriptor.
- src/nodeClass.js: read token from node.credentials; legacy fallback warns.
- src/specificClass.js: buildUpsertRequest emits folderUid when set.
- src/commands/handlers.js: pass folderUid from config to buildUpsertRequest.
- test/basic/slice34-credentials-and-folder.basic.test.js: 5 new tests.

Diff-based regeneration (F-1) and the explicit flows:started lifecycle hook
land in #36 once the S1 spike predicate is wired. Until then, the existing
child.register message trigger continues to drive composition on every
startup-time child registration.

Closes #34

test/basic/slice34-credentials-and-folder.basic.test.js

@@ -0,0 +1,43 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const DashboardApi = require('../../src/specificClass.js');
+
+test('buildUpsertRequest emits folderUid when configured', () => {
+  const api = new DashboardApi({
+    grafanaConnector: { folderUid: 'rnd-folder' },
+  });
+  const req = api.buildUpsertRequest({ dashboard: { uid: 'x', title: 'X' } });
+  assert.equal(req.folderUid, 'rnd-folder');
+  assert.equal(req.overwrite, true);
+  assert.ok(!('folderId' in req), 'should not emit folderId when folderUid is set');
+});
+
+test('buildUpsertRequest omits folderUid when empty (Grafana defaults to General)', () => {
+  const api = new DashboardApi({});
+  const req = api.buildUpsertRequest({ dashboard: { uid: 'x' } });
+  assert.equal(req.folderUid, undefined);
+  // folderId fallback only when explicitly passed
+  assert.equal(req.folderId, undefined);
+});
+
+test('buildUpsertRequest folderUid override at call-site wins over config', () => {
+  const api = new DashboardApi({ grafanaConnector: { folderUid: 'rnd-folder' } });
+  const req = api.buildUpsertRequest({ dashboard: { uid: 'x' }, folderUid: 'override-folder' });
+  assert.equal(req.folderUid, 'override-folder');
+});
+
+test('bearerToken from config flows into specificClass config', () => {
+  const api = new DashboardApi({
+    grafanaConnector: { bearerToken: 'tok-xyz', folderUid: '' },
+  });
+  assert.equal(api.config.grafanaConnector.bearerToken, 'tok-xyz');
+});
+
+test('default config has empty bearerToken and folderUid', () => {
+  const api = new DashboardApi({});
+  assert.equal(api.config.grafanaConnector.bearerToken, '');
+  assert.equal(api.config.grafanaConnector.folderUid, '');
+});