feat(apim-apps): add external credentials support for new applications

Applications can now declare a `credentials:` list in the YAML manifest.
Each entry holds a static `client_id` (and optional `secret`) that is
provisioned via POST /applications/{id}/extcredentials when the application
is first created. Existing applications are never modified.

Also adds CHANGELOG.md and ROADMAP.md for the v0.1.0 initial release.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apim_apps/client.py

@@ -98,6 +98,12 @@ class AxwayClient:
             "state":          "approved",
         })
 
+    def create_app_ext_credential(self, app_id: str, client_id: str, secret: str = "") -> dict:
+        payload: dict = {"clientId": client_id, "enabled": True}
+        if secret:
+            payload["secret"] = secret
+        return self._post(f"/applications/{app_id}/extcredentials", payload)
+
     # ── APIs front-end ────────────────────────────────────────────────────────
 
     def list_frontend_apis(self) -> list[dict]: