Implement Credentials Manager Container for Automated Token Management

# Implement Credentials Manager Container for Automated Token Management

## Overview

Implement a dedicated credentials manager container to handle authentication token management for MCP servers that require OAuth, API keys, or other authentication mechanisms.

## Problem

MCP servers registered in the gateway may require their own authentication tokens (OAuth, API keys, etc.). Currently:
- Tokens must be manually managed as environment variables
- No automatic token refresh mechanism
- Registry health checks and tool fetching fail when tokens expire or are missing
- Each new authenticated server requires manual docker-compose configuration updates

## Proposed Solution

A dedicated **Credentials Manager** service that:
1. Stores and manages authentication credentials for registered MCP servers
2. Handles token generation and automatic refresh
3. Provides an internal API for the registry to fetch current tokens
4. Supports multiple authentication types with **provider-agnostic OAuth2**

## Design

**Full Design Document**: [`.scratchpad/credentials-manager-design.md`](.scratchpad/credentials-manager-design.md)

### Key Features

- **Provider-Agnostic OAuth2**: Single implementation works with Cognito, Keycloak, Okta, Auth0, Azure AD, etc.
- **Automatic Token Refresh**: Background scheduler refreshes tokens before expiration
- **Internal API**: HTTP Basic Auth secured API accessible only via Docker network
- **Multiple Auth Types**: OAuth2 client credentials, OAuth2 refresh token, API keys, bearer tokens
- **Encrypted Storage**: All sensitive data encrypted at rest
- **Provider Auto-Detection**: Automatically detects OAuth provider from token URL

### Supported Authentication Types

#### OAuth2 Client Credentials (Provider-Agnostic)
Works with any OAuth2-compliant provider:
```json
{
"auth_type": "oauth2_client_credentials",
"config": {
"token_url": "https://oauth.provider.com/oauth2/token",
"client_id": "...",
"client_secret": "...",
"scope": "read write",
"grant_type": "client_credentials",
"refresh_before_expiry_seconds": 300
}
}
```

#### OAuth2 Refresh Token Flow
For user-delegated access with refresh tokens

#### Static API Key
For services using static API keys or bearer tokens

#### Static Bearer Token
For pre-generated bearer tokens (no refresh)

## Architecture

```
┌─────────────────┐
│ Registry │──────────────┐
│ Container │ │
└─────────────────┘ │
│ Internal API
┌─────────────────┐ │ (Docker Network)
│ Service Mgmt │ │
│ CLI Script │──────────────┤
└─────────────────┘ │
▼
┌─────────────────────┐
│ Credentials Manager │
│ Container │
├─────────────────────┤
│ - Token Storage │
│ - Refresh Logic │
│ - Internal API │
└─────────────────────┘
│
├─► Token Providers
│ (OAuth2, etc.)
│
└─► Persistent Storage
(Volume mounted)
```

## Implementation Phases

### Phase 1: Core Infrastructure
- [ ] Create credentials-manager container with FastAPI
- [ ] Implement storage layer (JSON file or SQLite)
- [ ] Implement encryption/decryption utilities
- [ ] Add basic CRUD endpoints for credentials
- [ ] Implement token retrieval endpoint

### Phase 2: Token Management
- [ ] Implement OAuth2 client credentials flow (provider-agnostic)
- [ ] Implement background refresh scheduler
- [ ] Add token expiry checking logic
- [ ] Implement retry logic with exponential backoff
- [ ] Add health status tracking
- [ ] Add provider auto-detection from token_url

### Phase 3: Registry Integration
- [ ] Update MCP client to call credentials manager
- [ ] Update health check service to use tokens
- [ ] Add error handling for missing/expired tokens
- [ ] Update tool fetching to use tokens

### Phase 4: CLI Integration
- [ ] Add credentials commands to service_mgmt.sh
- [ ] Create credential config validation
- [ ] Add credentials verification during server registration
- [ ] Update delete workflow to clean up credentials

### Phase 5: Additional Auth Types
- [ ] Implement static API key support
- [ ] Implement OAuth2 refresh token flow
- [ ] Implement bearer token support
- [ ] Add AWS SigV4 support for AWS services (optional)

### Phase 6: Monitoring & Operations
- [ ] Add metrics endpoint for token refresh stats
- [ ] Implement alerting for refresh failures
- [ ] Add credential rotation support
- [ ] Create admin UI for credential management

## API Endpoints

```
POST /api/credentials/register # Register credentials for a server
GET /api/credentials/token/{path} # Get current valid token
POST /api/credentials/refresh/{path} # Force refresh token
DELETE /api/credentials/{path} # Remove credentials
GET /api/credentials/list # List all credentials
GET /api/credentials/status/{path} # Get credential status
```

## Security

- **Encryption at Rest**: All tokens and secrets encrypted with Fernet
- **HTTP Basic Auth**: Internal API secured with admin credentials
- **Network Isolation**: Only accessible via Docker internal network
- **No Public Exposure**: Not exposed to public internet
- **Audit Logging**: All credential access logged (without exposing secrets)

## Example Use Cases

### AWS Cognito (Customer Support Assistant)
```bash
./cli/service_mgmt.sh add-credentials customer-support-assistant \
--auth-type oauth2_client_credentials \
--token-url "https://cognito-idp.us-east-1.amazonaws.com/oauth2/token" \
--client-id "..." \
--client-secret-file /path/to/secret
```

### Keycloak
```bash
./cli/service_mgmt.sh add-credentials keycloak-server \
--auth-type oauth2_client_credentials \
--token-url "https://keycloak.example.com/realms/mcp/protocol/openid-connect/token" \
--client-id "..." \
--client-secret-file /path/to/secret
```

### Static API Key
```bash
./cli/service_mgmt.sh add-credentials sre-gateway \
--auth-type api_key \
--api-key-file /path/to/token
```

## Benefits

1. **Automated Token Management**: No manual token updates needed
2. **Provider Agnostic**: Works with any OAuth2 provider
3. **Zero Downtime**: Tokens refreshed before expiration
4. **Better Observability**: Clear status and health indicators
5. **Secure**: Encrypted storage and internal-only API
6. **Scalable**: Can manage tokens for unlimited servers

## Related Issues

- #167 - Revert temporary health check status workaround (depends on this)

## Documentation

## Acceptance Criteria

- [ ] Credentials manager container running and healthy
- [ ] OAuth2 token refresh working for AWS Cognito
- [ ] OAuth2 token refresh working for Keycloak
- [ ] Static API key support working
- [ ] Registry health checks use credentials manager
- [ ] Tool fetching uses credentials manager
- [ ] CLI commands for credential management working
- [ ] Automatic token refresh before expiration
- [ ] Encrypted storage implemented
- [ ] Documentation complete