updateConfigTokenRef uses global config instead of injected provider

Summary

pkg/registry/auth/oauth_token_source.go:updateConfigTokenRef calls the package-level config.UpdateConfig(...) function rather than going through an injected config.Provider interface.

This means the token reference/expiry is always written to the default config file location, even when a non-default config path is in use (e.g., via PathProvider in tests or custom deployments).

Impact

• In tests using custom config paths, the token reference may be written to the wrong file
• Inconsistent with the rest of the auth flow which properly uses injected config.Provider

Suggested Fix

Pass a config.Provider into the oauthTokenSource constructor (or pass an updateFn func(func(*config.Config)) error callback), and use it in updateConfigTokenRef instead of the global function.

Context

Found during review of #4121 (registry login/logout CLI commands).

🤖 Generated with Claude Code

Start in pkg/registry/auth/oauth_token_source.go at updateConfigTokenRef and trace the oauthTokenSource constructor and existing config.Provider usage in the auth flow. Reproduce the behavior with a non-default config path such as the PathProvider setup mentioned in the issue. Done means the token reference and expiry are written through the injected provider, with coverage for the custom path.