old-style credentials magic → scoped credentials

Instead of saving the username and password as a single `_auth` blob in the user configuration, save **either** a registry-scoped bearer token **or** a list of username, (base64-encoded) password, and email address, all registry-scoped. Could maybe migrate existing global `_auth` / `email` to registry-scoped equivalents on load, but it's probably better just to force people to log in anew.

There's not a really good way to set the types and defaults for dynamically-named configuration properties. Maybe it would make sense to use INI stanzas instead?