feat(apim-apps): add external credentials support for new applications

Applications can now declare a `credentials:` list in the YAML manifest.
Each entry holds a static `client_id` (and optional `secret`) that is
provisioned via POST /applications/{id}/extcredentials when the application
is first created. Existing applications are never modified.

Also adds CHANGELOG.md and ROADMAP.md for the v0.1.0 initial release.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apim_apps/models.py

@@ -7,6 +7,12 @@ class ApiAccess:
     api_version: str = ""
 
 
+@dataclass
+class AppCredential:
+    client_id: str
+    secret: str = ""
+
+
 @dataclass
 class AppSpec:
     name: str
@@ -17,6 +23,7 @@ class AppSpec:
     enabled: bool = True
     apis: list["ApiAccess"] = field(default_factory=list)
     environments: list[str] = field(default_factory=list)
+    credentials: list["AppCredential"] = field(default_factory=list)
 
 
 @dataclass