feat(17-01): add credential profile service, router, device assignment

- Service with CRUD + Transit encryption for all new credential writes
- Router with 6 endpoints under /tenants/{tenant_id}/credential-profiles
- Delete returns HTTP 409 with device_count when devices reference profile
- Registered credential_profiles_router in main.py
- DeviceUpdate schema accepts optional credential_profile_id
- update_device validates profile belongs to tenant before assigning

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/schemas/device.py

@@ -35,6 +35,7 @@ class DeviceUpdate(BaseModel):
     latitude: Optional[float] = None
     longitude: Optional[float] = None
     tls_mode: Optional[str] = None
+    credential_profile_id: Optional[uuid.UUID] = None
 
     @field_validator("tls_mode")
     @classmethod