Tracker credentials are ship-declared service identities

[czpython]

Linear and Jira credentials move off ship's extension settings onto the service-identity seam (#224): they are the appliance's standing identity at the tracker — one per deployment, all-or-nothing, paired with a webhook secret — the same shape as the GitHub App. This is the first extension-declared use of the seam.

What moves

contrib/ship/services.py declares the two services:

• Linear — API key + webhook secret. verify proves the key with a viewer/organization query and stores the actor and workspace as identity facts.
• Jira — base URL, email, API token, webhook secret. verify calls /rest/api/3/myself and stores the reported display name; base URL and email are non-secret facts shown on the card.

Both are required = False: trackerless installs stay healthy. The generic connect cards, verify-before-store, and doctor coverage all come from the seam — no frontend or wire changes in this PR.

What stays on ship settings

The tracker selector and the trigger/resting statuses — workflow policy, not identity. Connection and selection are independent: both trackers can be connected while the selector picks one. One new ship doctor check reports the cross-concern state: a selected-but-unconnected tracker is pending operator setup; trackerless by choice is healthy.

Consumers

• Ship.get_tracker() builds clients from the service rows; a missing identity means trackerless, and the half-configured-Jira failure class is gone (connect is all-or-nothing).
• Both webhooks verify against the row's stored secret and answer 401 "not connected" when the identity is absent, matching the GitHub webhook's behavior. _issue_url reads the Jira base URL from the row.
• The clean() pairing rules are deleted — the connect form subsumes them.

Tracker credentials now live in the encrypted service_identities column; the docs' encryption-envelope caveat no longer lists them.

Deploy

One-time re-paste per live box, same as the GitHub App pattern: connect Linear/Jira from Settings → Harnesses after rollout. The old settings-override rows are orphaned and harmless.

🤖 Generated with Claude Code