Move the configuration checksum process, minute polling, reconnection and stale-result handling into ProviderConfigWatcher. Keep cache restoration, quota invalidation and refresh scheduling in the applet.

Validate bounded checksum observations in a pure module. Malformed replies preserve cached quotas and do not trigger a refresh; valid config-path precedence and persisted checksum fingerprints remain compatible.

Update development and usage guides, the Unreleased changelog and regression coverage. Existing settings, translations, metadata and parity TODO remain unchanged.

Validation: make check (91 Python tests and 1,231 Qt checks with no skips), packaging, installed Plasma runtime scenarios, CI and CodeQL passed on a3fb7d2. The CodeRabbit checksum finding is fixed and its thread resolved. PR #257 records the full results.