Introduce Provider credential references and OS secret-store migration #92

Part of #71.

Outcome

Replace secret-bearing Provider fields with backend-only credential references and migrate supported credentials into an OS-protected secret store.

Scope

• Introduce auth_kind and opaque credential_ref boundaries.
• Store API keys and future access/refresh tokens in an OS credential vault.
• Return only masked availability/status to the frontend.
• Migrate existing plaintext keys and environment references with explicit preview, rollback, and failure recovery.
• Add atomic, cross-process-safe secret updates and comprehensive redaction.

Non-goals

• OAuth authorization flows, Provider-specific subscription support, or importing credentials from other applications.

Acceptance criteria

• Raw secrets are unavailable to the frontend after storage.
• Logs, telemetry, diagnostics, exports, fixtures, and errors redact every credential form.
• Migration is explicit, atomic, recoverable, and preserves environment-reference behavior.
• Missing or inaccessible vault entries fail closed with actionable status.
• Provider credentials cannot weaken local Gateway authentication.

Required verification

• Vault adapter and migration tests, including rollback and concurrent updates.
• Frontend masked-state contract tests.
• Redaction tests across diagnostics, telemetry, exports, and errors.
• Native Windows smoke plus documented platform behavior for other supported OSes.