feat(apim-apps): add external credentials support for new applications

Applications can now declare a `credentials:` list in the YAML manifest.
Each entry holds a static `client_id` (and optional `secret`) that is
provisioned via POST /applications/{id}/extcredentials when the application
is first created. Existing applications are never modified.

Also adds CHANGELOG.md and ROADMAP.md for the v0.1.0 initial release.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -1,7 +1,9 @@
 # apim-apps
 
+![release](https://img.shields.io/badge/release-v0.1.0-blue.svg)
+
 CLI tool for managing Axway API Manager client applications from a YAML manifest.  
-Ensures compliance across multiple environments by creating missing applications and API subscriptions.
+Ensures compliance across multiple environments by creating missing applications, external credentials, and API subscriptions.
 
 ## How it works
 
@@ -75,12 +77,16 @@ applications:
     enabled: true
     environments:
       - DEV_LAN
+    credentials:
+      - client_id: "my-external-client-id"   # static external credential; optional secret:
     apis:
       - name: "Products"
         version: "v2"
       - "Notifications"           # short form — no version filter
 ```
 
+The `credentials` list is optional. Each entry provisions an external credential (`client_id`, optional `secret`) on the application via the API Manager's `/extcredentials` endpoint. Credentials are set **only when the application is first created** — existing applications are never modified.
+
 If you also want the tool to manage organisations, add an `organizations` section:
 
 ```yaml