feat(credentials): T8 回填端點 + T9 治理端點/CLI (credential-store-migration)

- POST /credentials/migrate-to-workers-secrets：舊 KV credential 逐筆解密回填 D1+Workers
  Secrets，冪等可審，重用 wasi-shim 唯一合法 crypto_decrypt 呼叫點
- GET /credentials 改讀 D1（與既有 /credentials/catalog 共用查詢）；DELETE 改為新家優先、
  舊 KV fallback，避免孤兒資料
- acr creds list/replace/delete 三支 CLI 薄殼指令；順手修好過期的 acr creds push（舊
  client 端加密格式已被 T5 取代）
- 新增 cypher-executor/tests/credentials.test.ts + D1 test fixture

T6/T7（讀取/注入路徑、雙讀 fallback）需要重新編譯 registry/components/auth_static_key
的 TinyGo WASM，本環境無 tinygo 且 proxy 擋 github.com 下載，卡在工具鏈缺口，詳細分析
記錄在 credential-store-migration.md。

端到端驗證：部署到 leo21c 帳號真實跑過 GET/POST/DELETE 三分支 + migrate 端點（對真實
既存的兩筆 credential 跑，發現 cypher-executor 自己的 ENCRYPTION_KEY secret 疑似為空，
誠實記錄為待 leo/總管裁決的不可逆風險項，未擅自重設）。

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cypher-executor/wrangler.test.toml

@@ -16,5 +16,22 @@ id = "test-exec-context"
 binding = "WEBHOOKS"
 id = "test-webhooks"
 
+[[kv_namespaces]]
+binding = "CREDENTIALS_KV"
+id = "test-credentials-kv"
+
+[[kv_namespaces]]
+binding = "RECIPES"
+id = "test-recipes"
+
+# credential-store-migration T8/T9 測試用 D1 mock（Miniflare 本地 SQLite，非真實 leo21c D1；
+# schema 由 tests/setup.ts 在測試啟動時建表，不用 migrations_dir——0002_credentials.sql 就一張表，
+# 直接 exec 比接 migrations 機制簡單）
+[[d1_databases]]
+binding = "CREDENTIALS_DB"
+database_name = "test-credentials-db"
+database_id = "test-credentials-db-id"
+
 [vars]
 ENVIRONMENT = "test"
+ENCRYPTION_KEY = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"