Unify git credentials under drive credential + remote per-principal management

CHANGELOG.md

@@ -1,3 +1,22 @@
+## 1.51.0
+
+### Changed
+
+- **Git credentials moved to `omnyshell drive credential`** and gained **remote
+  management**. The v1.50.0 `omnyshell node git-credential` command is **removed**;
+  all git-credential management is now under `drive credential`, with the mode chosen
+  explicitly:
+  - **`--local`** — manage credentials on **this node host**
+    (`~/.omnyshell/git-credentials.json`, mode 600), with `--global` (default) or
+    `--for-principal <p>`; supports `--ssh-key`/`--passphrase`.
+  - **`--node <node>`** — manage **your own** credentials on a **remote** node over the
+    hub (HTTPS only: `--pat`, `--username/--password`). Scoped to the calling principal:
+    the hub stamps the authenticated principal, so a client can only ever read/modify its
+    own credentials on that node — never the global scope or another principal's. Gated by
+    the same authorization as opening a drive on the node.
+  - Subcommands: `add <host>`, `list`, `remove <host>`; remote mode uses the shared
+    connection flags (`--hub`, `-u/--principal`, `-t/--token`, `--key`, `--ca`, …).
+
 ## 1.50.0
 
 ### Added

README.md

@@ -531,39 +531,48 @@ omnyshell drive mount --git https://github.com/acme/app.git \
 ```
 
 **Private remotes.** Because the *node* runs the clone/fetch/push, git
-authentication is configured **on the node host**. Register a per-host credential
-there with `omnyshell node git-credential`; it is picked up automatically for any
-git mount whose URL matches that host — no per-mount flags:
+credentials live **on the node host**. Manage them with `omnyshell drive
+credential`; a credential is picked up automatically for any git mount whose URL
+matches that host — no per-mount flags. Choose the target explicitly with
+`--local` (this node host) or `--node <node>` (a remote node, over the hub).
+
+**Remote — manage _your own_ credentials on a node (HTTPS only):**
 
 ```sh
-# On the node host:
-omnyshell node git-credential add github.com --pat <token>            # HTTPS PAT
-omnyshell node git-credential add gitlab.com --username me --password <pw>
-omnyshell node git-credential add github.com --ssh-key ~/.ssh/id_ed25519
-omnyshell node git-credential list                                    # secrets masked
-omnyshell node git-credential remove github.com
+omnyshell drive credential add github.com --pat <token> --node web-01
+omnyshell drive credential add gitlab.com --username me --password <pw> --node web-01
+omnyshell drive credential list   --node web-01          # your entries, masked
+omnyshell drive credential remove github.com --node web-01
 ```
 
-A credential is either **global** (node-wide) or scoped to a connecting
-**principal** with `--principal <p>`:
+Remote management is **scoped to the calling principal**: the hub stamps your
+authenticated identity, so you can only ever read or modify your own credentials on
+that node — never the global scope or another principal's. It is authorized exactly
+like opening a git drive on that node.
+
+**Local — node-host admin (run on the node), full scope control:**
 
 ```sh
-omnyshell node git-credential add github.com --pat <token>              # global
-omnyshell node git-credential add github.com --pat <alice-token> --principal alice
-omnyshell node git-credential list --principal alice
-omnyshell node git-credential remove github.com --principal alice
+# On the node host:
+omnyshell drive credential add github.com --pat <token> --local              # global (default)
+omnyshell drive credential add github.com --pat <t> --local --for-principal alice
+omnyshell drive credential add github.com --ssh-key ~/.ssh/id_ed25519 --local
+omnyshell drive credential list   --local                                    # secrets masked
+omnyshell drive credential remove github.com --local
 ```
 
-When a client opens a git mount, the node resolves the remote's credential
-**principal-first, then global**: it uses the connecting (hub-authenticated)
-principal's credential for that host, falling back to the node's global credential
-when the principal has none. One principal never sees another's credential.
+A credential is either **global** (node-wide) or scoped to a **principal**. When a
+client opens a git mount, the node resolves the remote's credential
+**principal-first, then global**, independently per host: it uses the connecting
+(hub-authenticated) principal's credential for that host, falling back to the node's
+global credential when the principal has none. One principal never sees another's.
 
 Credentials are stored in `~/.omnyshell/git-credentials.json` (mode `600`),
 separate from the client/hub auth store. They live **only** on the node: they are
 never sent to the Hub or peers and never serialized onto a mount (`mounts.json`)
 or drive. A missing or wrong credential fails fast rather than hanging on an
-interactive prompt. (SSH keys with a passphrase require an ssh-agent.)
+interactive prompt. (SSH keys with a passphrase require an ssh-agent, and can only
+be set with `--local` since the key path is node-side.)
 
 Restrict which sub-paths a directory mount serves with repeatable `--include`
 (whitelist) / `--exclude` (wins over include) globs — the filter is baked into the