feat(creds): future-proof Credential storage model

Replaces the opaque Bounty.bounty_type='credential' path with a
dedicated `credentials` table whose schema is forward-compatible
across every auth-bearing service in the fleet. Hoisted indexed
columns (secret_sha256, principal, service, attacker_ip) carry the
universal reuse-analytics signal; service-specific JSON keys ride
in `fields`. Cross-service reuse queries become an indexed lookup
on secret_sha256 instead of JSON_EXTRACT scans.

Schema decisions baked in (per ANTI):
- New `Credential` table, not extension to Bounty
- Hoisted `principal` column for cross-service principal-reuse
- Standardized JSON keys: every payload carries secret_b64 +
  secret_printable + principal universally; service-specific extras
  (user, domain, dn, mech, …) ride alongside

The auth-helper SD-block emits the new shape natively. The ingester
forks at _extract_bounty:
- Native shape (SSH/Telnet, future emitters): secret_b64 present →
  direct upsert_credential
- Legacy shape (FTP/POP3/IMAP/SMTP today): username + password →
  adapter synthesizes secret_{b64,sha256,printable} on the fly,
  upserts into the same Credential table. Tracked as DEBT-039;
  one-shot bridge until those service templates migrate.

Defense-in-depth across five layers (input validation):
- C helper: bytes outside [0x20, 0x7f) collapse to '?', RFC 5424
  escape rules for \\, ", ]; b64 preserves exact bytes
- Ingester native branch: rejects malformed secret_b64 (regex), drops
  the credential row but keeps the underlying Log
- Ingester legacy adapter: same printable-ASCII filter as the C
  code; sha256 + b64 over the original utf-8 bytes (lossless, even
  when secret_printable is sanitized)
- DB column caps with truncation warning; sha256 always over the
  full pre-truncation bytes so reuse queries match across truncation
- JSON serialized with ensure_ascii=True so utf8mb4 columns stay
  safe even with non-ASCII service-specific keys

Bounty.bounty_type='credential' is no longer written. Pre-v1: no
historical backfill; existing rows stay untouched but unused.

595 tests pass; new tests cover the model + repo (upsert dedup,
null-principal independence, cross-service reuse, filters), both
ingester branches, b64 validation, sanitization preserving the
fingerprinting signal in b64.

tests/db/test_base_repo.py

@@ -19,6 +19,11 @@ class DummyRepo(BaseRepository):
     async def add_bounty(self, d): await super().add_bounty(d)
     async def get_bounties(self, **kw): await super().get_bounties(**kw)
     async def get_total_bounties(self, **kw): await super().get_total_bounties(**kw)
+    async def upsert_credential(self, d): await super().upsert_credential(d); return 0
+    async def get_credentials(self, **kw): await super().get_credentials(**kw)
+    async def get_total_credentials(self, **kw): await super().get_total_credentials(**kw)
+    async def get_credentials_for_attacker(self, ip): await super().get_credentials_for_attacker(ip)
+    async def get_credential_reuse(self, h): await super().get_credential_reuse(h)
     async def get_state(self, k): await super().get_state(k)
     async def set_state(self, k, v): await super().set_state(k, v)
     async def get_max_log_id(self): await super().get_max_log_id()
@@ -64,6 +69,11 @@ async def test_base_repo_coverage():
     await dr.add_bounty({})
     await dr.get_bounties()
     await dr.get_total_bounties()
+    await dr.upsert_credential({})
+    await dr.get_credentials()
+    await dr.get_total_credentials()
+    await dr.get_credentials_for_attacker("1.2.3.4")
+    await dr.get_credential_reuse("abc")
     await dr.get_state("k")
     await dr.set_state("k", "v")
     await dr.get_max_log_id()