feat(credentials): file-backed provider layering process env over $DSH_HOME/.env

Live environment wins read-only (shadowed writes reject instead of
appearing to succeed); the file is the writable source with byte-preserving
line edits, a quoting ladder dotenv reads back verbatim, atomic 0600
writes, wholesale snapshot replacement on reload, and write-drain
teardown.

tsconfig.host.json

@@ -65,6 +65,7 @@
     { "path": "./packages/settings/settings" },
     { "path": "./packages/settings/settings-local" },
     { "path": "./packages/credentials/credentials" },
+    { "path": "./packages/credentials/credentials-local" },
     { "path": "./packages/session-query/tool-session-query" },
     { "path": "./packages/storage/storage" },
     { "path": "./packages/storage/storage-json" },