feat(tui): credentials CRUD end-to-end

[lvlcn-t]

What

PR 4 (final) of the TUI CRUD series (stacked on #22). Adds create,
edit, rename, and delete for credentials, completing CRUD across all
three tabs.

Note

Based on feat/tui-crud-contexts (#22). Review #20, #21, #22 first.

Changes

• CredentialsTab now uses the CRUD browse variant, binding
  n/e/r/ctrl+d.
• credentialForm is type-driven: the type field is validated against
  the four supported types; all conditional fields (client id/secret/cert,
  token source, and OIDC issuer/client-id/redirect/scopes) are shown, and
  credentialFromValues assembles only the fields relevant to the chosen
  type — the domain validates the result (matching how cmd set-credential
  works). On edit the name is locked read-only.
• Dispatch maps intent to CreateCredential/UpdateCredential/
  RenameCredential/DeleteCredential; rename cascades to referencing
  contexts, delete reports orphaned contexts in the status line.
• Removed the now-unused view-only browse constructor — all tabs are CRUD.

Testing

• service-principal and workload-identity (OAuth2) create, invalid-type
  rejection, in-place edit with a type change, rename with reference
  cascade, delete.
• Full go test -race ./... and pre-commit green; tui never imports
  cmd.

Series recap

PR	Scope
#20	Foundation + intent API (contexts.Manager reshaped)
#21	Tenants CRUD + edit-rename bug fix
#22	Contexts CRUD
#23	Credentials CRUD (this)

With this, the TUI has full CRUD on contexts, tenants, and credentials,
all mapping user intent to one shared contexts.Manager. The CLI migration
onto the intent API remains a separate follow-up.

[github-actions]

File	Coverage
All files	62%	❌
az/azconfig.go	66%	❌
az/client.go	0%	❌
az/client.go	0%	❌
az/commands.go	0%	❌
az/secrets.go	0%	❌
az/secrets.go	15%	❌
cmd/context_view.go	85%	✅
cmd/current.go	80%	✅
cmd/delete_context.go	71%	✅
cmd/get.go	56%	❌
cmd/list.go	46%	❌
cmd/output_flags.go	85%	✅
cmd/rename_context.go	69%	❌
cmd/set_context.go	69%	❌
cmd/set_credential.go	97%	✅
cmd/set_credential.go	80%	✅
cmd/set_tenant.go	95%	✅
cmd/set_tenant.go	57%	❌
cmd/use.go	47%	❌
cmd/view.go	95%	✅
cmd/view.go	48%	❌
config/config.go	91%	✅
config/credential.go	0%	❌
config/credential.go	64%	❌
config/credential.go	70%	✅
config/keyvault.go	14%	❌
config/loader.go	82%	✅
config/loader.go	79%	✅
config/store.go	69%	❌
config/writer.go	69%	❌
contexts/contexts.go	92%	✅
contexts/contexts.go	82%	✅
internal/gendemo/main.go	0%	❌
internal/gendoc/main.go	0%	❌
keyvault/azure.go	0%	❌
keyvault/azure.go	0%	❌
keyvault/keyvault.go	75%	✅
login/login.go	76%	✅
main.go	0%	❌
output/printer.go	79%	✅
semver/version.go	94%	✅
tui/app.go	0%	❌
tui/app.go	0%	❌
tui/tui.go	0%	❌
tui/details/viewer.go	0%	❌
tui/form/form.go	93%	✅
tui/keys/builder.go	80%	✅
tui/keys/keys.go	66%	❌
tui/splash/splash.go	0%	❌
tui/splash/splash.go	0%	❌
tui/state/state.go	71%	✅
tui/styles/azure_renderer.go	33%	❌
tui/styles/azure_renderer.go	8%	❌
tui/tabs/browse.go	56%	❌
tui/tabs/confirm.go	36%	❌
tui/tabs/context_item.go	0%	❌
tui/tabs/contexts.go	49%	❌
tui/tabs/credential_items.go	90%	✅
tui/tabs/credential_items.go	0%	❌
tui/tabs/list_builder.go	83%	✅
tui/tabs/tab.go	70%	✅
tui/tabs/tabs.go	92%	✅
tui/tabs/tabs.go	57%	❌
tui/tabs/tenant_items.go	0%	❌
wif/factory/factory.go	0%	❌
wif/oauth2/browser.go	0%	❌
wif/oauth2/browser_linux.go	0%	❌
wif/oauth2/cache.go	76%	✅
wif/oauth2/cache.go	79%	✅
wif/oauth2/oauth2.go	25%	❌
wif/oauth2/oauth2.go	59%	❌
wif/options.go	20%	❌

Minimum allowed coverage is 70%

Generated by 🐒 cobertura-action against 637779b