feat: add GET /acr/credentials endpoint with temporary token support

## Description

Add a new `GET /acr/credentials` endpoint that returns short-lived ACR (Alibaba Cloud Container Registry) temporary credentials for image push/pull operations.

## Motivation

SDK clients need temporary credentials to authenticate with ACR for pushing and pulling container images. The endpoint uses admin-side long-lived AK/SK to call the ACR `GetAuthorizationToken` API and returns a 1-hour temporary username/password pair, keeping secrets server-side.

## Changes

- Add `AcrConfig` dataclass in `rock/config.py` (instance_id, region, AK/SK)
- Add `acr` section in YAML config
- Add `aliyun-python-sdk-cr` dependency
- Add `GET /acr/credentials` route on the proxy role
- Add `get_acr_credentials()` method in `SandboxProxyService`
- Add unit tests

Start with rock/config.py, the YAML configuration, the proxy-role routes, and SandboxProxyService to trace how configuration and service methods are wired. Add the ACR credentials endpoint and unit tests so it returns the one-hour temporary username/password pair from the ACR GetAuthorizationToken API without exposing the admin AK/SK.

Written by the indexing model from the issue text.