Credentials made for a member: show and delete

Security surface (credential authz). Run the autonomous security review lane before merge. (a) Reproduction: dev 1.2.636, operator acting as Org B, Secrets. The credential "zz-task6415 for Nora" was created by 6415 as Personal for Nora Test4208. The list's owner column and the row menu's "Owner:" line read "Debug Admin", the creator. 6415's report: the admin who created it gets 403 on delete, so a mistaken create cannot be undone. That probe row is still on dev for that reason. (b) Cause: after #5513 the list and row menu render `created_by` rather than `owner_id`. The Owner filter's query parameter is still `created_by_id`. Delete authz allows only the owner. (c) Fix: - Render the owner (`owner_id`'s user) in the Secrets row and row menu. - Rename the filter parameter to `owner_id`, keeping `created_by_id` accepted as an alias. - Allow delete of a Personal credential by an org Owner/Admin (or an operator acting as the tenant) when the credential's owner is a member of that org. This is the same `is_org_admin` test #5513 uses for create. Audit the delete with actor, acting_as and owner. - Once this ships, delete the dev probe "zz-task6415 for Nora" through the console. (d) Acceptance: - The row shows "Nora Test4208" for that credential (dev screenshot). - API tests: an admin deletes a member's Personal credential (204 plus an audit row); a plain member deleting another's gets 403; a cross-org delete gets 404. - The probe row is gone on dev. (e) Out of scope: Org/System ownership rules and the picker itself. Done means: the tests pass; `./dc check full` green; PR merged to develop; Jaah Deploy succeeded; the security lane verdict is in the PR body.

The Secrets row and menu now show a credential's owner, and an Org Owner/Admin or acting operator can delete a member's personal credential (audited). Owner filter uses owner_id; created_by_id still works. Full gate green, security lane pass, PR #5541 merged, Jaah Deploy succeeded. On dev the row showed "Nora Test4208" and the probe is deleted. Follow-ups are in the report: a hidden stale Owner filter, and ?q= ignored.