KRATOS a4b2e01fe6 feat: encrypted provider credentials + provider-aware /model (#329) ...

Encrypted credential storage
- internal/securefile: AES-256-GCM at-rest crypter (fail-closed, atomic, locked).
- internal/credstore: provider API-key store, keyring-first with an encrypted-file
  fallback; plaintext only via an explicit ZERO_CRED_STORAGE=file opt-out.
- Provider API keys no longer live in config.json: captured straight into the store
  from the wizard/CLI setup, and any existing inline plaintext key is migrated to the
  store on launch (fail-soft; stripped only after the store write succeeds).
- buildProvider and every model/provider switch reload the credential (stored key,
  env var, or OAuth bearer), so a stored-key provider always authenticates.
- `zero auth logout <provider>` now also removes the stored API key and its marker.

/model and /provider
- /model lists every authenticated provider (filtered to those with a usable
  credential), grouped per provider under section headers.
- Each provider's models are live-discovered (its real served models) rather than a
  static catalog; local providers show only the models actually pulled.
- Selecting a model from another provider switches provider and model together.
- /provider offers keep / replace / remove when a provider already has a stored key.

Gated throughout: go build, go vet ./..., go test ./... -race, lint.

2026-06-27 23:25:08 +05:30

..

secret_access_other.go

feat: encrypted provider credentials + provider-aware /model (#329)

2026-06-27 23:25:08 +05:30

secret_access_windows.go

feat: encrypted provider credentials + provider-aware /model (#329)

2026-06-27 23:25:08 +05:30

securefile_test.go

feat: encrypted provider credentials + provider-aware /model (#329)

2026-06-27 23:25:08 +05:30

securefile.go

feat: encrypted provider credentials + provider-aware /model (#329)

2026-06-27 23:25:08 +05:30