feat(apim-apps): add external credentials support for new applications

Applications can now declare a `credentials:` list in the YAML manifest.
Each entry holds a static `client_id` (and optional `secret`) that is
provisioned via POST /applications/{id}/extcredentials when the application
is first created. Existing applications are never modified.

Also adds CHANGELOG.md and ROADMAP.md for the v0.1.0 initial release.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps.yaml

@@ -18,6 +18,8 @@ applications:
     description: "Application mobile grand public"
     email: "mobile-app@example.com"
     enabled: true
+    credentials:
+      - client_id: "my-external-client-id"
     apis:
       - name: "Catalogue-Produits"
         version: "v2"