feat(bat-022): daemon CRUD admin API + self-service credential management (REQ-052/053/054)

- POST/PATCH/deactivate/activate /v1/admin/daemons — admin-only daemon CRUD (REQ-053)
- GET/PUT/DELETE /v1/daemons/{daemon_id}/credential — user-owned scoped credential management (REQ-052)
- Owner re-assignment auto-invalidates BrokerCredential via update_daemon_owner() (REQ-053 AC-4)
- Deactivation auto-revokes service tokens via revoke_tokens_by_daemon_id() (REQ-022 reuse, REQ-053 AC-6)
- DELETE /v1/admin/daemons/{id} → 405 (hard delete not provided, REQ-053 AC-8)
- All responses exclude app_key/app_secret; Fernet encryption at rest (REQ-054)
- Service-token → 403 on credential endpoints (REQ-052 AC-10)
- Admin ownership scope enforced: admin cannot write other user's credential (REQ-052 AC-9)
- REQ-051 regression: 4 service-token guard tests pass (REQ-054 AC-7)
- 44 new tests, 565 total passed (521 baseline + 44 new), 0 failures

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VHtM5Ws1HKCKQ4JGi6GRb5

app/main.py

@@ -11,7 +11,9 @@ from app.api.auth_routes import router as auth_router
 from app.api.portfolios import router as portfolio_router
 from app.api.strategy_sets import router as strategy_sets_router
 from app.api.users import router as users_router
+from app.api.v1_admin_daemons import router as v1_admin_daemons_router
 from app.api.v1_assets import router as v1_assets_router
+from app.api.v1_daemon_credential import router as v1_daemon_credential_router
 from app.api.v1_daemons import router as v1_daemons_router
 from app.api.v1_portfolios import router as v1_portfolios_router
 from app.api.v1_tags import router as v1_tags_router
@@ -81,7 +83,9 @@ def create_app(
     app.include_router(portfolio_router)
     app.include_router(strategy_sets_router)
     app.include_router(users_router)
+    app.include_router(v1_admin_daemons_router)
     app.include_router(v1_assets_router)
+    app.include_router(v1_daemon_credential_router)
     app.include_router(v1_daemons_router)
     app.include_router(v1_portfolios_router)
     app.include_router(v1_tags_router)