Phase B-2 of provider abstraction. CredentialsVault migrates flat v0
schema (volcengine.* / ark.* dot-style keys) to versioned v1 with
providers.{asr,llm}.* sections. Original v0 file backed up to
credentials.v0.bak.<timestamp>.json before any write. Atomic write
preserves 0600 mode. 14 unit tests covering fresh/full/partial
v0/already-v1/futureVersion/damaged/backup-conflict cases.
Existing CredentialsVault public API unchanged — no caller (Settings,
DictationCoordinator) needed modification.
Branch: feature/credentials-schema-v1
baiqing
b48d60f74c