feat(credentials): organization-level shared credentials

[suda]

Summary

Credentials (PM keys, GitHub/GitLab tokens, Sentry, engine/LLM keys) can now be defined once per organization and are inherited by every project in it. A project-level credential with the same env var key overrides the org value for that project — so a new project needs zero credential re-entry.

How it works

• New org_credentials table (migration 0062), values encrypted with AAD = org_id (project credentials keep AAD = project_id).
• Inheritance lives in the two chokepoint resolvers (resolveProjectCredential / resolveAllProjectCredentials). Everything downstream inherits org values automatically: worker env injection, secretBuilder, PM discovery, webhook signature verification, GitHub personas, hasIntegration checks. Zero worker-side changes — the router merges tiers before flattening CASCADE_CREDENTIAL_KEYS.
• tRPC: organization.credentials.{list,set,delete}, gated by per-org admin role (same refinement pattern as users.ts). List returns masked previews only.
• projects.credentials.list now merges the org tier: each row carries source: 'project' | 'org' and hasOrgFallback; existing consumers keep working unchanged.
• UI: new Settings → Credentials page with a grouped catalog (Source Control / Project Management / Alerting from the credential-role registry, Engines/LLM from ENGINE_SECRETS) plus free-form custom keys. ProjectSecretField shows an "Inherited from org ****xxxx" badge, an "Override organization value..." placeholder, and revert-to-org delete semantics.
• CLI: cascade org credentials-set / credentials-list / credentials-delete.

Notes for review

• Webhook verification behavior change: a project without e.g. GITHUB_WEBHOOK_SECRET now inherits the org secret — a previously-unverified webhook path may start enforcing verification. Intended.
• Codex token refresh (CODEX_AUTH_JSON write-back) intentionally stays project-scoped, creating an override over an org-inherited seed (documented inline).
• Deleting a project override naturally reverts to the org value — projects.credentials.delete needed no changes.
• Historical context: an org-level credentials table existed pre-0040 and was collapsed into the project tier; this re-introduces the tier with live inheritance instead of a one-time backfill.

Testing

• Unit: 10,979 passed (new: orgCredentialsRepository CRUD/AAD tests; fallback matrix in credentialsRepository; org-admin gating + masking in organization router; DTO merge cases in projects router).
• Integration: full credential inheritance matrix green (org-only inherit, project override wins, delete-override reverts, per-tier AAD under encryption).
• Pre-existing failures unrelated to this change: coalesce-bullmq + 2 github-personas tests require a local Redis (confirmed failing on clean tree).

🤖 Generated with Claude Code

[suda]

Scope extended: the Claude Code subscription limits feature (previously PR #3's superadmin sidebar widget) is now folded into the credential views on this branch:

• claudeCodeLimits.forOrg (org-admin gated): usage for the org-level shared token and each project-level override, with source attribution — rendered as a Claude Code Usage section on Settings → Credentials.
• claudeCodeLimits.forProject: usage for the credential candidates a project can run on (its override vs the inherited org token) with the active one marked — rendered as a picker preview under CLAUDE_CODE_OAUTH_TOKEN on the project engine tab.
• Sidebar widget deleted. Server env token deliberately not surfaced (dashboard env ≠ router env that workers get, and it's an operator secret whose billing data shouldn't reach tenant org members — store it as an org credential instead).
• Per-row decrypt resilience: one corrupted credential row no longer 500s the limits endpoints.

Adversarial review workflow ran over the diff (3 lenses, per-finding verification); all 4 confirmed findings fixed in fb628fa.