docs: document the credentials API and the ApplicationDefinition credentials block #753

The Cozystack API is gaining a credentials API (design: https://github.com/cozystack/community/blob/main/design-proposals/user-secrets-api/README.md, implementation in cozystack/cozystack on branch feat/user-secrets-api, PR link to follow in a comment). Two pages need updating once it lands, under content/en/docs/next/:

• cozystack-api/application-definitions.md: the ApplicationDefinition gains an optional spec.credentials block (format, secretLabels, valuesPath, accounts) whose presence converts a kind to platform-minted credentials. The field reference in the CRD at packages/system/application-definition-crd/definition/cozystack.io_applicationdefinitions.yaml carries the descriptions.
• A new page for the core.cozystack.io/v1alpha1 credentials resource and its mint and revoke subresources: what a Credential shows (status.password.origin, status.history), that a mint returns the password once and a revoke discards it, the preconditions.resourceVersion conflict, and which tenant tiers may read, mint and revoke.

The operations page on the kube-apiserver audit log, with the policy for distributions that ship none and the fluent-bit.extraOutputs value of monitoring-agents, lives in the cozystack repository at docs/operations/audit-log.md and can be mirrored under the install or operations section.

No managed application is converted yet; the first wave (PostgreSQL, MariaDB, ClickHouse) follows in separate PRs, each of which will reference this issue for the per-application pages.