Werkzeugkasten: Zugangsdaten je Einheit (#692)

A unit holds credentials for its members, by tool and setting - needed once,
not once per agent, and other units never get them.

- UnitConfig.credentials, protected by ConfigSecrets like every secret.
- OrgChart.ToolSettingsFor: an agent's own settings, completed by the nearest
  unit up that holds the value; own non-empty values win; no tool is granted.
  Used for runs, tool jobs and preflight probes.
- OrgAdministration.SetUnitCredential, PUT /organisation/units/{id}/credentials;
  the view lists held settings, never values.
- Templates never carry unit credentials; they are named instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/ClawdDotNet.App/AppHost.cs

@@ -796,9 +796,7 @@ public sealed class AppHost : IAsyncDisposable
                 if (agent is null)
                     return null;
 
-                var toolConfig = agent.Tools.TryGetValue(toolName, out var cfg)
-                    ? cfg.AsReadOnly()
-                    : new Dictionary<string, object?>().AsReadOnly();
+                var toolConfig = Core.Organisation.OrgChart.From(instance).ToolSettingsFor(agent, toolName);
 
                 return new AgentToolContext(
                     agent.AgentId,