Nest credential sections under go2rtc in frigate config

Frigate rejects unknown top-level keys (extra="forbid" on root config),
but its RestreamConfig (go2rtc: block) allows extra keys. Move credential
sections under go2rtc: with 2/4 space indentation.

- writeCredentials emits "  xiaomi:" + "    \"<key>\": <value>"
- upsertSection matches 2-space section header + 4-space key regex
- insertNewSection places new nested sections after streams: block
- findStreamInsertPoint stops at sibling headers (2-space) inside go2rtc:
- Add xiaomi_test.go with 16 scenarios covering new config, addToConfig
  merging, token refresh, dedup, sort order, malformed URLs, special chars,
  go2rtc override, mixed protocols, and section order

pkg/generate/config.go

@@ -155,8 +155,10 @@ func newConfig(info *cameraInfo, req *Request) string {
 
 	b.WriteString("go2rtc:\n  streams:\n")
 	writeStreamLines(&b, info)
-
 	writeCredentials(&b, info.Credentials)
+	if len(info.Credentials) == 0 {
+		b.WriteByte('\n')
+	}
 
 	b.WriteString("cameras:\n")
 	writeCameraBlock(&b, info, req)