fix: preserve credentials during connection renames

[Maxteabag]

Summary

• hydrate omitted database and SSH credentials from the original connection name before a rename
• write and verify destination credentials before updating the shared index or deleting the source entries
• surface keyring read failures during destructive migrations
• restore pre-existing destination credentials after partial keyring, plaintext-backend, or index-write failures

Why

Follow-up to #289. The per-connection save path is correct, but its initial rename ordering could delete credentials before omitted values were recovered or before destination writes succeeded.

Verification

• uv run pytest -q tests/test_connection_store_save_one.py tests/test_credentials_connection_store.py tests/test_credentials_keyring.py — 46 passed
• uv run pytest -q tests --ignore=tests/integration -k 'not test_detect_strategy_pip_user_fallback' — 1,817 passed, 555 skipped, 1 known environment-sensitive test deselected
• live PostgreSQL and SQL Server Docker connection checks — 2 passed with provider extras
• Ruff — clean
• autoreview — clean, no accepted/actionable findings

Regression coverage includes omitted DB/SSH credentials, failed migration reads, partial destination writes, raw backend failures, rollback behavior, and preservation of an existing destination entry.