Werkzeugkasten: Zugangsdaten je Einheit (#692)

A unit holds credentials for its members, by tool and setting - needed once,
not once per agent, and other units never get them.

- UnitConfig.credentials, protected by ConfigSecrets like every secret.
- OrgChart.ToolSettingsFor: an agent's own settings, completed by the nearest
  unit up that holds the value; own non-empty values win; no tool is granted.
  Used for runs, tool jobs and preflight probes.
- OrgAdministration.SetUnitCredential, PUT /organisation/units/{id}/credentials;
  the view lists held settings, never values.
- Templates never carry unit credentials; they are named instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/ClawdDotNet.Core/Security/ConfigSecrets.cs

@@ -63,6 +63,13 @@ public static class ConfigSecrets
 
         foreach (var agent in config.Agents)
             Apply(agent, transform);
+
+        // #692: everything a unit holds for its members is a secret, whatever its name.
+        foreach (var unit in config.Units)
+            foreach (var settings in unit.Credentials?.Values ?? Enumerable.Empty<Dictionary<string, string>>())
+                foreach (var key in settings.Keys.ToList())
+                    if (settings[key] is { Length: > 0 } value)
+                        settings[key] = transform(value) ?? "";
     }
 
     // ─── Agent ───