feat(storage): add per-mount credentials and PikPak

[chius-me]

Summary

• store OAuth application credentials and provider/account secrets per mount in the existing encrypted D1 credential envelope
• add explicit nested credential patch semantics, sanitized connection status, safe disconnect behavior, and legacy Worker-secret fallback
• extend the storage WebUI for per-mount OneDrive, Google Drive, Dropbox, S3, and PikPak credentials
• add a PikPak driver with password-to-token exchange, encrypted session refresh, pagination, configured-root enforcement, original-file download proxying with Range forwarding, and file management
• update deployment/setup documentation so only infrastructure secrets are required at Worker level

PikPak capability note

PikPak upload and provider-side copy are intentionally not advertised in this change. Calls receive a stable unsupported response until a safely testable streaming upload-ticket flow is available; the Worker never buffers a full upload as a fallback.

Validation

• npm run check
  • TypeScript typecheck passed
  • production build passed
  • Worker: 49 files / 460 tests passed
  • UI: 16 files / 142 tests passed
  • scripts: 2 files / 12 tests passed

Refs #4