Add CredentialProvider trait, CredentialSet enum, and ConfigCredentialProvider

Define the outbound authentication abstraction in alknet_core::credentials:
- CredentialProvider trait with get_credentials and refresh_credentials
- CredentialSet enum with ApiKey, Basic, Bearer, S3AccessKey, OidcToken, Custom variants
- ConfigCredentialProvider reads credentials from DynamicConfig.credentials
- SecretStoreCredentialProvider stub returns None for all lookups (Phase 3)
- Wire CredentialProvider into OperationEnv via credentials() method
- Add credentials HashMap field to DynamicConfig

crates/alknet-core/src/lib.rs

@@ -55,6 +55,7 @@ pub mod auth;
 pub mod call;
 pub mod client;
 pub mod config;
+pub mod credentials;
 pub mod error;
 pub mod interface;
 pub mod server;
@@ -84,6 +85,9 @@ pub use config::{
     AuthPolicy, ConfigReloadHandle, ConfigServiceImpl, DynamicConfig, ForwardingAction,
     ForwardingPolicy, ForwardingRule, RateLimitConfig, StaticConfig, TargetPattern,
 };
+pub use credentials::{
+    ConfigCredentialProvider, CredentialProvider, CredentialSet, SecretStoreCredentialProvider,
+};
 pub use error::{AuthError, ChannelError, ConfigError, ForwardError, TransportError};
 pub use interface::{
     is_valid_pair, DnsInterface, DnsInterfaceConfig, HttpInterface, HttpInterfaceConfig,