OIDC transfer ownership and delegated user credentials

[swelborn]

we need a table for UserCredentials, and repo/model updates to insert these credentials. we store the iss/sub/email now in the transfer table as well.

we store this as a separate table without foreign key relationship, because the credentials will be deleted after they expire

---

This is part 17 of 23 in a stack made with GitButler:

•  23  use historical=True as a fallback if job not found #52
•  22  test coverage for credential boundary #51
•  21  remove "force" option for cache shutdown #50
•  20  client/service/workflow changes for IRI token delegation changes #49
•  19  add cache table to track caches #48
•  18  authenticated principal + encrypted delegated-credential capture #47
•  17  OIDC transfer ownership and delegated user credentials #46 👈
•  16  WIP for shared cache shutdown #45
•  15  add jobspec override #44
•  14  add mostly claude-gen usage example package #43
•  13  ability to share a cache amongst different transfers #42
•  12  add precommit hook for checking openapi client drift #40
•  11  pin python version to 3.14 #41
•  10  build frontend image in CI #39
•  9  add frontend #38
•  8  add frontend client (autogenerated) #37
•  7  lazily construct settings #36
•  6  add autogenerated client #35
•  5  add alembic #34
•  4  add ability to get logs from v2 api services thru iri #29
•  3  functional core tests for transfer and producer #30
•  2  api with durable execution and saga #28
•  1  deps for v2 #27