refactor(db): split credentials.py into a credentials/ subpackage

Splits the 459-line credentials.py into two submixins plus a composing
CredentialsMixin in credentials/__init__.py:

  _core.py    (~190)  Credential capture: upsert, list, filters,
                      per-attacker / per-secret reads, attacker_uuid
                      backfill
  reuse.py    (~270)  CredentialReuse correlation: upsert, candidate
                      mining, list/get + the _enrich_with_secret helper
                      that lifts the printable/b64 from underlying rows

_merge_unique stays with reuse.py (its only caller).
_enrich_with_secret stays with reuse.py — it's an internal helper of
list_credential_reuses / get_credential_reuse_by_id, never called
from the capture path.

decnet/web/db/sqlmodel_repo/credentials/__init__.py

@@ -0,0 +1,20 @@
+"""Credential capture + credential-reuse correlation.
+
+Capture (per-attempt rows) lives in ``_core.py``; the reuse correlator
+(grouping rows that share a secret triple) lives in ``reuse.py``.
+``CredentialsMixin`` composes the two.
+"""
+from __future__ import annotations
+
+from decnet.web.db.sqlmodel_repo.credentials._core import CredentialsCoreMixin
+from decnet.web.db.sqlmodel_repo.credentials.reuse import CredentialReuseMixin
+
+
+class CredentialsMixin(
+    CredentialReuseMixin,
+    CredentialsCoreMixin,
+):
+    """Composed credentials mixin — see submixins for the actual methods."""
+
+
+__all__ = ["CredentialsMixin"]