docs(platform): explain project environment credentials

[yannickmonney]

Project administrators currently find only a tab name when looking for a way to give an agent credentials. Add a linked Environment section to the existing projects overview in English, German and French, using shipped UI labels. Cover encrypted storage, naming and uniqueness, replacing/deleting write-only values, admin access, archived-project restrictions and read-failure recovery.

Current source differs from #4454’s catalog-based premise: project credentials are stored but not injected into runtime runs. The guide states this limitation and links the working organization Secrets grant path, including the Member-run restriction. The editor accepts ^[A-Za-z_][A-Za-z0-9_]*$, while the server uppercases names and requires an initial letter and at most 64 characters; the guide explains both. No personal/project/agent/automation precedence is invented.

Evidence for independent review at this PR’s base:

• backend/domains/projects/secrets.ts lists metadata only and writes app.project_secrets; lib/shared/schemas/secrets.ts defines the stricter server rule.
• backend/core/node_only/sandbox/turn_equipment.ts resolves organization secrets and broker credentials only; backend/domains/agent_secrets/service.ts reads app.agent_secrets, not project secrets.
• Task and automation hosts call that resolver with granted names. There is no runtime reader of app.project_secrets in current source. The Environment catalog’s runtime-injection wording therefore needs a separate product follow-up; this PR changes docs only.

Validation: git diff --check; existing docs outline/link/glossary suite (3 files, 25 tests passed, one worker); bun run lint:links (449 docs pages, every link lands); normal commit hooks (conflict check, formatter and commitlint). Two resource readings 21 seconds apart passed before the docs suite, with fresh post-phase guards before links and commit. Formatting preserved the exact tested source blobs. No installs, builds or stacks. Live UI and rendered-page verification NOT_RUN because builds/stacks are outside the admitted scope.

Refs #4454 and TALE-1021. Implements TALE-1040. Independent review requested; not merged.

[yannickmonney]

ACCEPT — reviewed at exact head 821f170.

Disposition:

• DOCS: ACCEPT. The en/de/fr sections accurately describe encrypted project-scoped storage, metadata-only listings, replacement/deletion, normalization and naming constraints, admin-only access, archived read-only behavior, load/refresh failure behavior, and the current runtime boundary. The Environment links and #environment-credentials anchors resolve in all three locales. The agent setup links resolve to the locale-specific headings.
• LOCALE: ACCEPT. German and French use the shipped Environment/Secrets/editor terminology and preserve the English meaning.
• UX-CLARITY: ACCEPT. An administrator has actionable steps to add, replace, and delete a credential, and the text explains that agent-run environment variables come from organization Secrets grants.
• SECURITY: ACCEPT. Values are described as write-only and never shown again; the docs explicitly state that project values are not currently injected into runs and that ordinary Chat does not receive the organization environment variables.
• CODE: NOT_APPLICABLE (docs-only diff).
• DATA: NOT_APPLICABLE (docs-only diff).
• PERFORMANCE: NOT_APPLICABLE (docs-only diff).
• Other topics: NOT_APPLICABLE (docs-only diff).

Source checks covered the project secrets service/UI, the shared secret-name schema, admin/archived gates, organization-secret runtime injection, and the en/de/fr platform catalogs.

[yannickmonney]

Merge-lane coverage dispositions at 821f1704adfe9a95d08a1658fe89406f71ecb00d. From agent #2 (TALE-359 run 0d0927b5), the merger.

• Implementer: C8 579ebc6d (TALE-1040).
• Independent ACCEPT at this exact head: C12 31b27429 (card 1c4bffc3), comment 6028215030.
• Independence: I am neither the author nor a reviewer of this PR.
• Composition: Composition: the seven merge-ready PRs compose cleanly in sequence on main 5b6ab36b (fix(platform): stage re-delivered outputs by last write #4452, fix(platform): prevent unsafe crawl fast-path skips #4451, fix(platform): align agent details locale terminology #4461, fix(platform): retain comment edits across log window threshold #4460, docs(platform): explain project environment credentials #4463, fix(platform): contain optional lazy chunk failures #4458, fix: localize governance model access labels #4462). They share no files, and the final composed tree is 5ef5a8c6. This PR's patch-id is the same on main and against its own merge base (fd98d85d).

Topic	Disposition	Basis
DOCS	PASS	C12: the en/de/fr sections cover encrypted project-scoped storage, metadata-only listing, replace and delete, naming rules, admin-only and archived read-only behavior, failures and the runtime boundary. Links and anchors resolve in all three locales. The Docs container test, Playwright (docs) and Format (including the link check) passed.
LOCALE	PASS	Uses the shipped Environment/Secrets terminology in DE and FR (C12).
UX-CLARITY	PASS	Actionable add, replace and delete steps. It explains that run variables come from organization Secrets grants (C12).
SECURITY	PASS	States that values are write-only, never shown again, not injected into runs, and not given to ordinary Chat. C12 checked this against the source.
UX-SIMPLICITY, A11Y, UI-RESPONSIVE, REL-MANUAL	NOT_APPLICABLE	No product UI or behavior change. The docs pages were built and tested in the docs container.
CODE, DATA, PERFORMANCE, RESOURCES	NOT_APPLICABLE	Docs-only diff (3 files). #4454 stays open: the PR documents the current source, which differs from #4454's premise (Refs only).
CICD	PASS	67 checks: 35 success, 32 skips, 0 failing. All 7 CI-ready aggregators and every PR-scope job succeeded. The 8 extra skips are path-filtered lanes behind PR scope, covered by a per-PR allowlist with a recorded reason.
DEPLOYMENT, RECOVERY, PROVIDERS, OBSERVABILITY, WORKFLOW	NOT_APPLICABLE	Docs-site content only.

Merge-gate dry run at 01:56:14Z: open, CLEAN, head matches; no required contexts. checks total=67 not-completed=0 failing=0 [skipped=32 success=35] neutral=[] statuses=[pending total=0]. Every skip is on the by-design allowlist skip-allow-4463.txt; no check is pending or failing. Merging next with --squash --match-head-commit 821f1704adfe9a95d08a1658fe89406f71ecb00d.