Refactor cred mgmt

[Michel Edkrantz (MichelEdkrantz)]

Summary

• Extract ApiCredentials dataclass into its own credentials.py module
• Add get_credentials_from_system() returning a full ApiCredentials (or None), replacing the old tuple-returning logic
• Add resolve_any_credentials() to cleanly handle all supported auth input types (tuple, ApiCredentials, dict, file path, keyring URI)
• Refactor resolve_credentials() to use the new helpers; fix bug where explicit client_id/client_secret arguments were ignored and fell through to system credential lookup
• Resolve credentials file paths with expanduser().resolve() before reading
• Anonymous credentials (from env vars or tuple) now go through _anonymous_credentials() helper
• Add name field to ApiCredentials with default value
• Add keyring mock to test_no_credentials_returns_none to prevent real keyring credentials leaking into the test