Set surface credentials from MCP

The MCP admin tools can now finish a surface setup end to end. create_surface and update_surface accept two new objects:

• inbound: inbound auth config, for example { "secret": "..." } to require HMAC signature verification on a webhook surface.
• outbound: provider credentials such as a Telegram bot token or Sendblue keys.

Recognized credential fields are encrypted at rest, and credential values are redacted in tool responses, so secrets never land in an agent transcript. Setup-readiness steps now recommend update_surface as the primary headless path, with the REST API as fallback.

Note the replace semantics on update: inbound and outbound each replace the stored value wholesale, and an empty object clears it.