feat(capability): per-scope BYO provider credentials + Twilio SMS egress

IIOS becomes the tenant's integration/credential hub for anything it sends.
New IiosProviderCredential (one row per scope+providerType) seals the secret
with AES-256-GCM under IIOS_CRED_KEY (secret-crypto.ts); only non-secret
displayHints are ever read back. ProviderCredentialService upsert/resolve/status;
TwilioSmsProvider resolves the caller's own creds per scope at send time and
POSTs to Twilio (fail-closed NOT_CONFIGURED when unset). Registered over the
SMS sandbox only when the platform key + store are present. PUT/GET
/v1/providers/:type/credentials (scope-fenced, masked reads). 16 new unit tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/iios-service/src/capability/capability.module.ts

@@ -2,15 +2,20 @@ import { Module } from '@nestjs/common';
 import { MediaModule } from '../media/media.module';
 import { CapabilityProviderRegistry } from './capability.registry';
 import { CapabilityBroker } from './capability.broker';
+import { ProviderCredentialService } from './provider-credential.service';
+import { ProviderCredentialController } from './provider-credential.controller';
 
 /**
  * The governed egress boundary (P9 slice 1). Exports the broker + registry so the
  * outbound layer routes all sends through policy + obligations + a pluggable
  * provider. PLATFORM_PORTS (for the opa gate) comes from the @Global PlatformModule.
+ * Also owns per-scope BYO provider credentials (Twilio SMS, …) — sealed at rest and
+ * resolved by the channel providers at send time.
  */
 @Module({
   imports: [MediaModule],
-  providers: [CapabilityProviderRegistry, CapabilityBroker],
-  exports: [CapabilityBroker, CapabilityProviderRegistry],
+  controllers: [ProviderCredentialController],
+  providers: [CapabilityProviderRegistry, CapabilityBroker, ProviderCredentialService],
+  exports: [CapabilityBroker, CapabilityProviderRegistry, ProviderCredentialService],
 })
 export class CapabilityModule {}