[P2-creds] Per-user credential scoping for hosted mode

[frankbria]

Context

#718 enforced a single-trust-domain model: in hosted mode the shared, machine-wide credential + GitHub-PAT mutation endpoints fail closed (403), and hosted tenants supply keys via per-instance env vars. This issue tracks the richer alternative — letting each hosted tenant store/manage their own credentials through the API.

Why deferred from #718

CredentialManager is machine-wide (keyring / encrypted-file keyed by provider, no user dimension). Per-user scoping is a cross-cutting rework, not a one-session change.

Acceptance criteria

• CredentialManager keys credentials by user_id (keyring service name + encrypted-file store), with a migration for existing machine-wide entries.
• Credential + GitHub-PAT endpoints thread auth["user_id"] and operate on the caller's own credentials only.
• Remove the hosted-mode 403 block from [P0.7] Bind workspaces to an owner and scope credentials per-user (multi-user IDOR + shared machine-wide secrets) #718 once per-user storage is safe.
• Tests: tenant A cannot read/overwrite/delete tenant B's stored key; each tenant sees only its own key status.

Anchors

• codeframe/core/credentials.py — CredentialManager (machine-wide today)
• codeframe/ui/dependencies.py — forbid_shared_credentials_in_hosted_mode (remove once scoped)
• codeframe/ui/routers/settings_v2.py, github_integrations_v2.py — credential endpoints

[coderabbitai]

🔗 Related PRs

#320 - test(core): add integration tests for credentials and environment modules [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!