docs: split credentials.md into an overview and a per-secret reference

The overview keeps the store invariant, the mTLS exception and the
minter/reader/renewal contract. The table of every credential and the
operating notes (forge token checks, re-creating agents, revoking a queue
credential, store login retries) move unchanged to credentials-reference.md,
and the links that asked where a credential lives point there.

docs/integrations/github.md

@@ -50,7 +50,7 @@ when the token changed. It needs a store identity
 (`services.hyperhive.agent.bao.addr`); an agent without one gets no token.
 The unit never deletes the file: a `github-token` already in place stays
 when the store holds none or doesn't answer. Where the token lives and who
-reads it: [credentials.md](../swarm/credentials.md).
+reads it: [credentials-reference.md](../swarm/credentials-reference.md).
 
 ## Security