feat(credentials): support managed credential synchronization (#2490)

* feat(credentials): support managed credential synchronization

Allow managed callers to upsert credentials with an exact ID, secret,
permissions, reuse policy, and expiry.

Return non-secret attributes plus a public-key fingerprint so callers can
verify relay credential consistency.

Persist imported credentials atomically and preserve identity and expiry
across restarts.

* fix(credentials): make managed upserts durable

Write the candidate credential snapshot before committing it to memory.
Propagate storage failures so controllers can retry instead of observing
false convergence.

Cover a transient storage failure to verify that memory stays unchanged
and the retry persists the credential.

* fix(credentials): atomically replace stored snapshots

Define CredentialStorage::store as an atomic replacement boundary and
use atomic-write-file in the management adapter. This keeps the last
committed credential JSON readable when a replacement fails.

Cover replacement of an existing credential snapshot and keep the
dependency scoped to the management feature.

easytier/Cargo.toml

@@ -87,6 +87,7 @@ bytes = "1.5.0"
 pin-project-lite = "0.2.13"
 
 atomic_refcell = "0.1.13"
+atomic-write-file = { version = "0.2.3", optional = true }
 
 quinn = { version = "0.11.8", optional = true, features = ["ring"] }
 quinn-proto = { version = "0.11.12", optional = true }
@@ -413,6 +414,7 @@ extended-services = [
     "proxy-cidr-monitor",
 ]
 management = [
+    "dep:atomic-write-file",
     "web-client",
     "logging",
     "easytier-core/management",