Phase 23: credential shape

Credentials can name the role of their primary value, include a label and version-aware environment-variable name, represent cookie and user-agent secrets, and choose a copy profile. These changes make exported configuration more precise without replacing the underlying encrypted vault format.