Werkzeugkasten: Zugangsdaten je Einheit (#692)

A unit holds credentials for its members, by tool and setting - needed once,
not once per agent, and other units never get them.

- UnitConfig.credentials, protected by ConfigSecrets like every secret.
- OrgChart.ToolSettingsFor: an agent's own settings, completed by the nearest
  unit up that holds the value; own non-empty values win; no tool is granted.
  Used for runs, tool jobs and preflight probes.
- OrgAdministration.SetUnitCredential, PUT /organisation/units/{id}/credentials;
  the view lists held settings, never values.
- Templates never carry unit credentials; they are named instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/ClawdDotNet.App.Tests/Services/OrgAdministrationTests.cs

@@ -330,6 +330,22 @@ public sealed class OrgAdministrationTests : IDisposable
         Unit("marketing").Votes.ShouldBeNull();
     }
 
+    // ═══════════════════ credentials per unit (#692) ═══════════════════
+
+    [Fact]
+    public void A_unit_holds_a_credential_until_it_is_removed()
+    {
+        BuildMarketing();
+
+        Org.SetUnitCredential("marketing", "", "apiKey", "x").Ok.ShouldBeFalse();
+        Org.SetUnitCredential("marketing", "WebFetch", "token", "t-1", "shared key").Ok.ShouldBeTrue();
+        Unit("marketing").Credentials!["WebFetch"]["token"].ShouldBe("t-1");
+        Org.Current().ToolSettingsFor(Find("ads"), "WebFetch")["token"].ShouldBe("t-1", "ads sits in amazon, below marketing");
+
+        Org.SetUnitCredential("marketing", "webfetch", "TOKEN", null).Ok.ShouldBeTrue();
+        Unit("marketing").Credentials.ShouldBeNull();
+    }
+
     // ═══════════════════ templates (#691) ═══════════════════
 
     private static Core.Organisation.OrgTemplate Shop() => new()