fix(credentials): remove inline SSH credential read-fallback (#748, ARC-4)

[hellodk]

Closes #748

Summary

ARC-4: eliminate the second SSH-secret resolution path. Node/group SSH secrets historically lived in inline ssh_* columns; the credential-consolidation epic (#704) moved them into the first-class Credential store (credential_id), and migrations 055/058 copied + NULLed the inline columns. But the service layer still read the inline columns as a fallback, leaving two secret-resolution paths. This PR removes that read path.

• services/credential_resolver.py — drop the inline node/group branches and the _inline_node_creds / _inline_group_creds helpers. Resolution now flows solely through the Credential store (node/group credential_id) plus the controller/global platform tiers. _primary_group_stmt is eligible by credential_id only. Added NoUsableCredentialError + require_usable_node_credentials(/_sync) so credential-required callers (WebSSH, VNC, password-mode bootstrap) fail loudly instead of silently degrading — the explicit replacement for the old inline fallback.
• services/ssh_credential_link.py — owner_secret_flags no longer consults the inline columns; secret presence comes from the linked Credential only.
• services/node_import.py, tool_calling.py, bootstrap_svc.py — audited: node_import only parses import input (and bootstrap_svc converts inline input into a Credential link via upsert_owner_ssh_credential), so import ergonomics are preserved and nothing persists/reads an inline dual path. tool_calling does not touch SSH creds. No changes required.

New failure mode (security-relevant)

Previously, a node with no credential_id but legacy inline data resolved via the inline columns. Now the inline columns are never read, so such a node resolves to no usable secret. Call sites that require a secret should use require_usable_node_credentials(/_sync), which raises NoUsableCredentialError with a clear, actionable message rather than attempting a connection with the wrong/empty secret.

Migration note (head 060 → 061): DEFERRED

The task asked for migration 061 to DROP the inline columns "once no code reads them". That precondition is not yet met: workers/ansible_tasks.py and api/routes/{groups,nodes}.py (owned by sibling PRs, out of this PR's scope) still read the inline columns. Dropping them now would break those modules at runtime and fail the repo-wide mypy gate on files this PR must not touch.

So this PR removes the service-layer read path (the ARC-4 security goal) and defers the physical column drop:

• The inline columns remain on models/node.py / models/group.py (now unread by the service layer, annotated as deprecated).
• owner_secret_flags keeps inline_password_enc / inline_key_enc kwargs (accepted-but-ignored) so sibling-owned route callers keep type-checking during the staged removal.
• Once the sibling reader-removal PRs land, the follow-up is mechanical: drop the four columns on nodes/groups in migration 061 (down_revision = "060", current verified head), remove the SQLAlchemy column defs, and delete the deprecated owner_secret_flags kwargs.

Backward-compat caveats

• require_usable_node_credentials is additive; existing callers of resolve_node_credentials(/_sync) are unaffected (signatures unchanged, dict shape unchanged, credential_source unchanged).
• Un-migrated rows that still carry only inline secrets (no credential_id) will now resolve to the group/controller/global tier instead of inline — expected, since the store is authoritative after 055/058.

Test plan

• uv run pytest tests/unit/test_748_no_inline_ssh_fallback.py -q — new, 12 tests, all pass.
• Updated test_credential_resolver.py, test_credential_resolver_sync.py, test_playbook_credentials_b279.py to the credential-store-only contract — pass.
• uv run python -c "import fleet_platform.api.main" — smoke import OK.
• tests/unit/test_migration_chain_guard_571.py — pass (chain unchanged).
• Pre-commit gate green (ruff, mypy, vulture, bandit).

Note: a handful of unrelated unit tests fail in the sandbox due to missing optional deps (asyncssh, ansible_runner) — verified identical on base origin/master, so not introduced here.

Made with Cursor

[github-actions]

Coverage Report

✅ 86.1% on fleet_platform/services/ (gate: 80%)

Gate passed

[github-actions]

Coverage Report

✅ 86.0% on fleet_platform/services/ (gate: 80%)

Gate passed

[github-actions]

Coverage Report

✅ 86.0% on fleet_platform/services/ (gate: 80%)

Gate passed

[github-actions]

Coverage Report

✅ fleet_platform/services/ 86.0% (gate: 80%)

✅ fleet_platform/agent/ 94.7% (gate: 80%)

Gate passed

[github-actions]

Coverage Report

✅ fleet_platform/services/ 86.0% (gate: 80%)

✅ fleet_platform/agent/ 94.7% (gate: 80%)

Gate passed