chore(amuleapi): stop exporting credential internals, and correct the API docs - #667

Follow-up to #665. No behaviour change.

Unused exports

Two symbols were exported with no caller. kPbkdf2Iterations is a tuning constant, not part of the contract; IsValidRecord has its rule enforced inside LoadCredentialsFile and is invoked nowhere else — not even by a test. Both move into the anonymous namespace. An exported symbol with no caller invites the next reader to assume it is load-bearing.

The reason IsValidRecord exists — a record that can never verify has to be rejected at load, because at login it is indistinguishable from a wrong password — now sits on LoadCredentialsFile, where the behaviour actually is.

CredentialsFilePath stays exported but now says why: only the tests use it, to assert the path-joining rules without restating them.

Documentation

QUICKSTART-AMULEAPI.md still described amuleapi-passwords in its file table as holding "MD5-hashed admin and guest passwords". They are salted PBKDF2-HMAC-SHA256 records, cannot be read back, and the file is written by aMule and amuled as well as amuleapi.

REFERENCE.md now explains why remote_controls reports amuleapi's enabled / port / bind but not whether its passwords are set. The omission is conspicuous next to the fields that are reported, and the reasons are worth stating: the credential file belongs to amuleapi and may live on a different host from amuled, so the daemon's view of it can be the wrong file — and this endpoint is readable by any authenticated role, whereas GET /auth/passwords is admin-only. webserver_guest_enabled is reported because it is a genuine amuled preference rather than a fact about another process's file.

Issue references dropped from REFERENCE.md (5) and EVENTS.md (1). They are parenthetical asides a reader of the published API reference cannot follow up on; that linkage belongs in code comments and PR bodies. CHANGELOG.md keeps its references, where citing issues is the point, as do the build-script comments under packaging/.

Verification

Builds clean; CredentialsTest and AmuleApiConfigTest pass; clang-format 18 clean; clang-tidy Tier-1 and Tier-2 clean with 0 compiler errors. No translatable strings changed, so no catalog regeneration.