feat(apim-apps): add external credentials support for new applications

Applications can now declare a `credentials:` list in the YAML manifest.
Each entry holds a static `client_id` (and optional `secret`) that is
provisioned via POST /applications/{id}/extcredentials when the application
is first created. Existing applications are never modified.

Also adds CHANGELOG.md and ROADMAP.md for the v0.1.0 initial release.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apim_apps/engine.py

@@ -102,6 +102,16 @@ def normalize_env(env: EnvConfig, manifest: Manifest, dry_run: bool) -> NormResu
                     log.error(msg)
                     result.errors.append(msg)
                     continue
+
+                app_id_new = created_app.get("id", "")
+                for cred in app_spec.credentials:
+                    try:
+                        client.create_app_ext_credential(app_id_new, cred.client_id, cred.secret)
+                        log.info(_c("green", f"{tag} ✅ External credential « {cred.client_id} » ajouté à « {app_spec.name} »"))
+                    except Exception as e:
+                        msg = f"{tag} ❌ Échec ajout external credential à « {app_spec.name} » : {e}"
+                        log.error(msg)
+                        result.errors.append(msg)
             result.actions_done.append(action_app)
         else:
             result.actions_skipped.append(action_app)