config: block credential/endpoint overrides from project .pscale.yml

[mscoutermarsh]

Summary

Project-scoped .pscale.yml (git root or cwd) was merged into viper with no key filter. A checked-in file could set api-url, api-token, or service-token / service-token-id, so pscale would send the user's keyring OAuth token to an attacker-controlled host.

Fix

• Replace unconditional MergeInConfig for project files with MergeProjectConfig, which only merges org, database, and branch.
• Ignore all other keys from directory-local config (including api-url and tokens).
• Warn on stderr when non-allowlisted keys are present so victims notice a hostile or mistaken config.
• User home config (~/.config/planetscale/pscale.yml), --config, flags, and env vars are unchanged.

Tests

• Allowlist filter rejects api-url / token keys
• Merge preserves a pre-set api-url and never imports project credentials
• Missing project file is a no-op

go test ./internal/config/ passes.