Problem: credentials were stored as plaintext JSON in the cache
file, with no integration with system credential managers.
Solution: add `lua/cp/git_credential.lua` wrapping the
`git credential fill/approve/reject` protocol. Maps each platform
to its host, handles CSES token as a second entry with
`path=api-token`.
