feat(BAT-005): add broker credential CLI command with persistence and tests

- Add CredentialService for managing broker credentials
- Implement credential CLI commands (create, list, get, update, delete)
- Add postgres repository support for credential operations
- Add comprehensive test coverage for credential CLI
- Update docs/batches/index.md and docs/srs/index.md with BAT-005
- Update docs/project-structure.md to reflect credential service

docs/project-structure.md

@@ -27,7 +27,7 @@
 - Type: mixed
 - Planned Entry Points:
 - uvicorn app.main:app :: serve the authenticated HTTP API, OpenAPI docs, and startup bootstrap hooks
-- pfhub :: run operational CLI commands for health, users, portfolios, strategies, and service tokens
+- pfhub :: run operational CLI commands for health, users, portfolios, strategies, service tokens, and broker credentials
 - alembic upgrade head :: apply ordered database schema migrations for persistent environments
 
 ## Purpose
@@ -87,6 +87,7 @@
   - All v1 endpoints require service-token authentication (token_source=db, token_type=service).
 - app/cli/
   - Defines the Typer entrypoint, command groups, output helpers, and operator-facing command flows.
+  - Command groups: `portfolio`, `strategy`, `user`, `service-token`, `credential` (broker credential management), and health commands (`health-check`, `init-db`, `migrate-db`).
 - app/core/
   - Owns configuration loading, auth guards, security helpers, and shared error handling.
   - `encryption.py`: Fernet-based credential payload encrypt/decrypt helpers. Reads `CREDENTIAL_ENCRYPTION_KEY` env var via `Settings.require_credential_encryption_key()`.