feat(apim-apps): add external credentials support for new applications

Applications can now declare a `credentials:` list in the YAML manifest.
Each entry holds a static `client_id` (and optional `secret`) that is
provisioned via POST /applications/{id}/extcredentials when the application
is first created. Existing applications are never modified.

Also adds CHANGELOG.md and ROADMAP.md for the v0.1.0 initial release.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apim_apps/loader.py

@@ -3,7 +3,7 @@ import textwrap
 
 import yaml
 
-from .models import ApiAccess, AppSpec, EnvConfig, Manifest, OrgSpec
+from .models import ApiAccess, AppCredential, AppSpec, EnvConfig, Manifest, OrgSpec
 
 EXAMPLE_MANIFEST = textwrap.dedent("""\
 # =============================================================================
@@ -26,6 +26,8 @@ applications:
     description: "Application mobile grand public"
     email: "mobile-app@example.com"
     enabled: true
+    credentials:
+      - client_id: "my-external-client-id"
     apis:
       - name: "Catalogue-Produits"
         version: "v2"
@@ -96,6 +98,11 @@ def load_manifest(path: str) -> Manifest:
                 apis.append(ApiAccess(api_name=api))
             else:
                 apis.append(ApiAccess(api_name=api["name"], api_version=api.get("version", "")))
+        credentials = [
+            AppCredential(client_id=c["client_id"], secret=c.get("secret", ""))
+            for c in a.get("credentials", [])
+            if c.get("client_id")
+        ]
         manifest.applications.append(AppSpec(
             name=a["name"],
             org_name=a["organization"],
@@ -105,6 +112,7 @@ def load_manifest(path: str) -> Manifest:
             enabled=a.get("enabled", True),
             apis=apis,
             environments=a.get("environments", []),
+            credentials=credentials,
         ))
 
     return manifest