chore: clean up cfg abbreviation and stale TODO link

Rename `cfg` parameter/local in resolve_mqtt_password to `config`
for PEP 8 compliance. Drop the broken reference to the long-removed
docs/plans/device-typed-configs.md from TODO.md.

TODO.md

@@ -524,7 +524,7 @@ Beyond the `/proc`-based AndroidMetricsProvider that's now in place:
 
 ## Refactor: Per-Provider Device Configs
 
-Replace flat `DeviceInfo` + `**kwargs` provider contract with a discriminated union of typed per-provider config dataclasses. Full plan: [docs/plans/device-typed-configs.md](docs/plans/device-typed-configs.md).
+Replace flat `DeviceInfo` + `**kwargs` provider contract with a discriminated union of typed per-provider config dataclasses.
 
 - [x] Phase 1 — `DeviceConfig` hierarchy + `Device.to_config()` (non-breaking, additive only)
 - [x] Phases 2+3 — narrow `LEDDeviceProvider.create_client` to typed configs; migrate 3 call sites; delete `DeviceInfo` + `_get_device_info` + `_DEVICE_FIELD_DEFAULTS` (single PR)

server/src/ledgrab/config.py

@@ -100,7 +100,7 @@ class MQTTConfig(BaseSettings):
     base_topic: str = "ledgrab"
 
 
-def resolve_mqtt_password(cfg: "Config | None" = None) -> str:
+def resolve_mqtt_password(config: "Config | None" = None) -> str:
     """Return the plaintext MQTT password.
 
     Accepts either an ``ENC:v1:`` envelope or legacy plaintext. If
@@ -110,8 +110,8 @@ def resolve_mqtt_password(cfg: "Config | None" = None) -> str:
     from ledgrab.utils import get_logger, secret_box
 
     log = get_logger(__name__)
-    cfg = cfg or get_config()
-    pw = cfg.mqtt.password or ""
+    config = config or get_config()
+    pw = config.mqtt.password or ""
     if not pw:
         return ""
     if secret_box.is_encrypted(pw):