feat(foundry): implement provider credential management (Claude, Codex)

Add credential extraction, injection, and UI for managing Claude and Codex OAuth credentials in sandbox environments. Credentials are stored per-user in the user actor, injected on task owner swap, and periodically re-extracted to capture token refreshes. Frontend account settings show provider sign-in status.

Changes:
- User actor: new userProviderCredentials table with upsert/get actions
- Task workspace: extract/inject provider credentials, integrate with owner swap and polling
- App snapshot: include provider credential status (anthropic/openai booleans)
- Frontend: new Providers section in account settings

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

foundry/packages/shared/src/app-shell.ts

@@ -4,12 +4,7 @@ export type FoundryBillingPlanId = "free" | "team";
 export type FoundryBillingStatus = "active" | "trialing" | "past_due" | "scheduled_cancel";
 export type FoundryGithubInstallationStatus = "connected" | "install_required" | "reconnect_required";
 export type FoundryGithubSyncStatus = "pending" | "syncing" | "synced" | "error";
-export type FoundryGithubSyncPhase =
-  | "discovering_repositories"
-  | "syncing_repositories"
-  | "syncing_branches"
-  | "syncing_members"
-  | "syncing_pull_requests";
+export type FoundryGithubSyncPhase = "discovering_repositories" | "syncing_repositories" | "syncing_branches" | "syncing_members" | "syncing_pull_requests";
 export type FoundryOrganizationKind = "personal" | "organization";
 export type FoundryStarterRepoStatus = "pending" | "starred" | "skipped";
 
@@ -85,6 +80,11 @@ export interface FoundryOrganization {
   repoCatalog: string[];
 }
 
+export interface FoundryProviderCredentialStatus {
+  anthropic: boolean;
+  openai: boolean;
+}
+
 export interface FoundryAppSnapshot {
   auth: {
     status: "signed_out" | "signed_in";
@@ -100,6 +100,7 @@ export interface FoundryAppSnapshot {
       skippedAt: number | null;
     };
   };
+  providerCredentials: FoundryProviderCredentialStatus;
   users: FoundryUser[];
   organizations: FoundryOrganization[];
 }