ResolveToken resolves an authentication token from a config subtree.
Resolution order:
cfg.auth.env — name of an environment variable to read
cfg.auth.value — literal token value stored in config
fallbackEnv — a well-known environment variable (pass "" to skip)
Returns an empty string when no token is found; callers decide whether
that is an error condition (e.g. private repositories require a token,
public repositories can proceed without one).