fix(server): preserve credential key names in redacted provider responses

[johntmyers]

Summary

Fix provider list and provider get showing 0 credential keys by replacing HashMap::clear() with value-only redaction in redact_provider_credentials.

Related Issue

Refs #350

Changes

• redact_provider_credentials now iterates values_mut() and replaces each value with "REDACTED" instead of calling credentials.clear()
• Credential key names and counts are preserved in gRPC responses while secret values remain hidden
• Updated three unit tests to assert redacted values ("REDACTED") instead of empty maps

Root Cause

Commit 2d3e6432 (part of security hardening PR #548) added redact_provider_credentials with credentials.clear() to prevent credential values from leaking over the API. This correctly hid secrets but also destroyed key names and the key count, causing provider list to show CREDENTIAL_KEYS: 0 and provider get to show <none> for credential keys.

Testing

• mise run pre-commit passes
• Unit tests updated to verify redacted values
• Verified on live cluster: openshell provider list now shows correct credential count

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)