Feature Request: Add a secure place to store API keys and connect apps via API in the Berd desktop app

### Before filing

- [x] I searched [open and closed issues](https://github.com/block/berd/issues?q=is%3Aissue) for duplicates.
- [x] I am using a recent [release](https://github.com/block/berd/releases) and this doesn't already exist.
- [x] This is one request, not several bundled together.

### Closest existing issue

none found

### Is this new, or an improvement?

New capability — Berd can't do this at all today

### The problem, in your terms

I want to use Berd with apps and agents that need API keys (for example, services like DetectzeStack and similar tools). Berd currently has no built-in UI or settings page where I can add, edit, or manage these keys, nor a simple “connect app via API” flow. That means I either hard-code them in config files, pass them via environment variables manually, or don’t use those integrations at all. The gap is: there’s no user-facing, secure, and discoverable way to manage API credentials and connect apps inside the Berd desktop app itself.

### What you do today

- Put keys in .env or other config files on disk and manage them myself.
- Or export them in the shell before running Berd.
- Or avoid using tools that require keys because the setup friction is too high.

### What you'd like to see

- A dedicated “API keys” or “Credentials” section in Berd’s Settings (desktop app).
- The ability to add named API keys (e.g., “DetectzeStack”, “OtherService”) and store them securely (encrypted at rest, not visible in plain text).
- The ability to revoke or rotate stored keys.
- Optionally scope keys to specific agents, rooms, or projects.
- Clear error messages if a key is missing or invalid when an agent tries to use it.
- An “API connect” flow to add apps/services via API (for example, a “Connect app via API” button that lets me paste an API key or use a guided setup for known services).

### Why this belongs in Berd itself

This is hard to solve cleanly from outside:

- Skills and agents would each need their own ad-hoc config mechanisms.
- Users would end up with scattered secrets in multiple files or tools.
- There’s no standard, secure, user-facing secret store that all agents can rely on.

A built-in credentials manager plus an “API connect” flow gives a single, consistent, auditable place for all integrations to read keys, and lets Berd enforce security policies (encryption, access control, rotation hints) in one place.

### Non-goals

- I am not asking Berd to become a full secrets vault for my entire system.
- I am not asking for automatic key generation for third-party services.
- I am not asking for a UI to manage unrelated secrets like SSH keys or database passwords unless they’re directly used by Berd agents.

### Alternatives you considered

_No response_

### Mockups, prior art, or other context

_No response_

The issue names no files, tests, or existing credential entry point. Start by locating the desktop app's Settings and integration/API entry points, then determine how secure storage and credential access are currently handled. Done would require an agreed scope and implementation for adding, editing, revoking, and securely using Berd API keys, with suitable error handling.

Written by the indexing model from the issue text.