Add secure tool-specific API key management <speculative, deep assessment needed.>

[zwadia]

This Speculative PR adds support for tool-specific API key management with the following features:

• Tools can declare credential requirements through a standard interface
• Users can configure credentials for tools through the settings UI
• Credentials are securely encrypted with AES-256-GCM in the session store
• Tool credentials are automatically passed when executing tool calls

Security considerations:

• Credentials are encrypted at rest
• Credentials are bound to specific user sessions
• HTTPS is required for secure transmission
• No plaintext storage of sensitive information

This implementation is minimally invasive but also speculative. It is intended to help fast-track API key management for tools, but it likely will not be the final implementation. To test and debug this locally, consider something like:

  git fetch origin

git checkout feature/tool-credentials