refactor(v2): remove trigger_credential_collection MCP tool

Drops the in-chat credential-collection flow introduced in e92b245. Agents
can no longer collect API keys via a secure modal — users must add secrets
through OneCLI directly. Keeps the OneCLI manual-approval handler and
threaded-routing work from the same commit intact.

Removed:
* container/agent-runner/src/mcp-tools/credentials.ts (MCP tool)
* src/credentials.ts (host-side modal/OneCLI pipeline)
* src/db/credentials.ts + migration 005 (pending_credentials table)
* src/onecli-secrets.ts (createSecret CLI facade, only caller was credentials.ts)
* findCredentialResponse from agent-runner DB layer
* PendingCredential types
* Four credential hooks from ChannelSetup (getCredentialForModal,
  onCredentialReject, onCredentialSubmit, onCredentialChannelUnsupported)
* Credential card/modal handling in chat-sdk-bridge (nccr/nccm prefixes,
  Modal/TextInput imports)
* credential_request text fallback in WhatsApp adapter
* request_credential system-action case in delivery.ts

Added:
* Migration 009 drops pending_credentials on existing installs.

Vercel skill now tells the agent to ask the user to register the token via
OneCLI instead of invoking the removed tool.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/types.ts

@@ -157,28 +157,6 @@ export interface PendingApproval {
   options_json: string;
 }
 
-// ── Pending credentials (central DB) ──
-
-export type PendingCredentialStatus = 'pending' | 'submitted' | 'saved' | 'rejected' | 'failed';
-
-export interface PendingCredential {
-  id: string;
-  agent_group_id: string;
-  session_id: string | null;
-  name: string;
-  type: 'generic' | 'anthropic';
-  host_pattern: string;
-  path_pattern: string | null;
-  header_name: string | null;
-  value_format: string | null;
-  description: string | null;
-  channel_type: string;
-  platform_id: string;
-  platform_message_id: string | null;
-  status: PendingCredentialStatus;
-  created_at: string;
-}
-
 // ── Agent destinations (central DB) ──
 
 export interface AgentDestination {