feat(credentials): abstract credential seam (ctx.credentials)

References-not-values doctrine: settings carry env-shaped CredentialRefs,
providers own storage. Per-operation resolve, UI-safe describe, fail-loud
set/unset under read-only shadowing, credentials/updated commit event with
a live-service invariant.

tsconfig.base.json

@@ -88,6 +88,7 @@
         "./packages/session-projection/*/src/invariant.ts",
         "./packages/session-query/*/src/invariant.ts",
         "./packages/settings/*/src/invariant.ts",
+        "./packages/credentials/*/src/invariant.ts",
         "./packages/telemetry/*/src/invariant.ts",
         "./packages/acp/*/src/invariant.ts",
         "./packages/storage/*/src/invariant.ts",
@@ -173,6 +174,7 @@
         "./packages/session-query/*/src",
         "./packages/session-title/*/src",
         "./packages/settings/*/src",
+        "./packages/credentials/*/src",
         "./packages/telemetry/*/src",
         "./packages/acp/*/src",
         "./packages/storage/*/src",