feat: add GET /acr/credentials endpoint with temporary token support #1110

Description

Add a new GET /acr/credentials endpoint that returns short-lived ACR (Alibaba Cloud Container Registry) temporary credentials for image push/pull operations.

Motivation

SDK clients need temporary credentials to authenticate with ACR for pushing and pulling container images. The endpoint uses admin-side long-lived AK/SK to call the ACR GetAuthorizationToken API and returns a 1-hour temporary username/password pair, keeping secrets server-side.

Changes

• Add AcrConfig dataclass in rock/config.py (instance_id, region, AK/SK)
• Add acr section in YAML config
• Add aliyun-python-sdk-cr dependency
• Add GET /acr/credentials route on the proxy role
• Add get_acr_credentials() method in SandboxProxyService
• Add unit tests