feat(bat-022): daemon CRUD admin API + self-service credential management (REQ-052/053/054)

- POST/PATCH/deactivate/activate /v1/admin/daemons — admin-only daemon CRUD (REQ-053)
- GET/PUT/DELETE /v1/daemons/{daemon_id}/credential — user-owned scoped credential management (REQ-052)
- Owner re-assignment auto-invalidates BrokerCredential via update_daemon_owner() (REQ-053 AC-4)
- Deactivation auto-revokes service tokens via revoke_tokens_by_daemon_id() (REQ-022 reuse, REQ-053 AC-6)
- DELETE /v1/admin/daemons/{id} → 405 (hard delete not provided, REQ-053 AC-8)
- All responses exclude app_key/app_secret; Fernet encryption at rest (REQ-054)
- Service-token → 403 on credential endpoints (REQ-052 AC-10)
- Admin ownership scope enforced: admin cannot write other user's credential (REQ-052 AC-9)
- REQ-051 regression: 4 service-token guard tests pass (REQ-054 AC-7)
- 44 new tests, 565 total passed (521 baseline + 44 new), 0 failures

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VHtM5Ws1HKCKQ4JGi6GRb5

app/schemas/v1.py

@@ -326,3 +326,52 @@ class DaemonResponse(BaseModel):
 class DaemonListResponse(BaseModel):
     daemons: list[DaemonResponse]
     total: int
+
+
+# ---------------------------------------------------------------------------
+# GET/PUT/DELETE /v1/daemons/{daemon_id}/credential (REQ-052)
+# ---------------------------------------------------------------------------
+
+class CredentialSetRequest(BaseModel):
+    """Credential write request — app_key/app_secret/account_ref inputs only.
+
+    Fernet-encrypted server-side; secret never returned in any response.
+    """
+    app_key: str = Field(..., min_length=1)
+    app_secret: str = Field(..., min_length=1)
+    account_ref: str = Field(..., min_length=1)
+    broker: str = Field(default="kis", min_length=1)
+
+
+class CredentialMetaResponse(BaseModel):
+    """Credential metadata response — secret fields intentionally absent (REQ-052, REQ-054)."""
+    daemon_id: str
+    broker: str
+    account_ref: str
+    has_credential: bool
+    credential_version: int
+    last_rotated_at: datetime | None = None
+
+
+# ---------------------------------------------------------------------------
+# POST/PATCH /v1/admin/daemons (REQ-053)
+# ---------------------------------------------------------------------------
+
+class DaemonCreateRequest(BaseModel):
+    daemon_slug: str = Field(..., min_length=1)
+    display_name: str | None = None
+    owner_user_id: str = Field(..., min_length=1)
+
+
+class DaemonUpdateRequest(BaseModel):
+    display_name: str | None = None
+    owner_user_id: str | None = None
+
+
+class DaemonAdminResponse(BaseModel):
+    """Admin daemon response — no credential fields (REQ-054)."""
+    id: str
+    daemon_slug: str
+    display_name: str | None = None
+    owner_user_id: str
+    is_active: bool