test(mysql-crud): add secret-bearing /users/{id}/credentials endpoint

[KC1706]

What

Adds a GET /users/{id}/credentials endpoint to the mysql-crud sample that returns a fixed, detected secret next to a benign sibling in both:

• the body — password (secret) / password_hint (benign sibling), and
• the response headers — Token (secret) / Token-Expiry (benign sibling).

The endpoint stores nothing and touches no table; the values are constants so CI can grep for them.

Why

Used by keploy/enterprise's selfhosted-cloud-replay e2e to exercise test-case response obfuscation (secret.ObfuscateTestCase) end to end. The existing sample endpoints return no secrets, so that obfuscation path was never exercised in a live record→replay. Recording this endpoint with secret protection enabled lets the pipeline assert the secret is redacted (not persisted in plaintext) while the benign sibling survives.

The secret + benign-sibling shape mirrors the exact over-broad-noise bug fixed in keploy/enterprise#2482 (body.password silencing body.password_hint; header Token silencing Token-Expiry).

Notes

• Additive only — no existing endpoint or behavior changes.
• The secret value is a generic high-entropy test string (not a real vendor token).

🤖 Generated with Claude Code