feat: replace credential proxy with OneCLI gateway for secret injection

package-lock.json

@@ -8,6 +8,7 @@
       "name": "nanoclaw",
       "version": "1.2.21",
       "dependencies": {
+        "@onecli-sh/sdk": "^0.1.6",
         "better-sqlite3": "^11.8.1",
         "cron-parser": "^5.5.0",
         "pino": "^9.6.0",
@@ -786,6 +787,15 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/@onecli-sh/sdk": {
+      "version": "0.1.6",
+      "resolved": "https://registry.npmjs.org/@onecli-sh/sdk/-/sdk-0.1.6.tgz",
+      "integrity": "sha512-kqVg8BOI6kapJaQjpTLBv91DhdKNykuSZIUsfb1pH5puyNlShWlXw5DWwxRVmxBihBMaIm+JyN9VRJMrVKZ5vQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/@pinojs/redact": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",