[architecture] Operator credentials roster UX fixes at scale

_Automatically composed from the parent epic at dispatch time._

Plan: derive roster facts and health in the config setter; tree on generated columns; keyset paging with 10k-capped counts; indexed and trigram filters; set-based all-or-nothing bulk. 8 children: C1a→{C1b,C2}→{C3,C4,C5,C6}→C7 (dev walk; dev unreachable from this node, deferred). Memory: none applied.