feat(credentials): abstract credential seam (ctx.credentials)

References-not-values doctrine: settings carry env-shaped CredentialRefs,
providers own storage. Per-operation resolve, UI-safe describe, fail-loud
set/unset under read-only shadowing, credentials/updated commit event with
a live-service invariant.

tsconfig.host.json

@@ -64,6 +64,7 @@
     { "path": "./packages/session-query/session-query-sqlite" },
     { "path": "./packages/settings/settings" },
     { "path": "./packages/settings/settings-local" },
+    { "path": "./packages/credentials/credentials" },
     { "path": "./packages/session-query/tool-session-query" },
     { "path": "./packages/storage/storage" },
     { "path": "./packages/storage/storage-json" },