Resolve credentialRefs on synchronous evaluate endpoints

[krisztianfekete]

The credential ContextVar that LLM-as-Judge graders read was populated only by the async run worker, so the synchronous /api/evaluate* paths could authenticate judges only from the process environment.

This PR wires credentialRefs into all four sync endpoints (/evaluate, /evaluate/stream, /evaluate/json, /evaluate/json/stream), mirroring the worker's set/reset pattern, so multi-trace synchronous callers can use judges too.

[Copilot]

Pull request overview

This PR ensures synchronous evaluation endpoints can authenticate LLM-as-judge graders using per-request credentialRefs, by resolving secret references into the same credential ContextVar used by the async worker.

Changes:

• Added a _resolved_credentials() async context manager to resolve + scope credentials for sync /api/evaluate* routes (including streaming task inheritance).
• Plumbed credentialRefs support into /api/evaluate, /api/evaluate/stream, /api/evaluate/json, and /api/evaluate/json/stream.
• Added API tests that assert credentials are resolved at evaluator invocation time for both multipart and JSON endpoints.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/agentevals/api/routes.py	Adds credentialRef resolution/scoping and wires it through all sync evaluate endpoints (including streaming task creation).
src/agentevals/api/models.py	Extends the JSON request model to accept credentialRefs (via camelCase aliasing).
tests/test_api.py	Adds regression tests validating credentialRef resolution behavior across sync endpoints and error cases.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.