refactor(services): ResolvedProjectCredentials dataclass over (stack_url, token) tuple (#516 NB-1)

[padak]

Addresses NB-1 from the #516 review.

⚠️ Stacked on #516. Base branch is feat/512-table-snapshots, not main, because snapshot_service.py (one of the three files) only exists on that branch. Merge #516 first; GitHub will retarget this to main automatically. The diff below is only the refactor (4 files).

Why

The three single-project services — token, stream, snapshot — each carried a byte-identical helper:

def _resolve_project(self, alias: str) -> tuple[str, str]:
    ...
    return project.stack_url, project.token

That bare (stack_url, token) 2-tuple is exactly the heterogeneous positional return CONTRIBUTING.md forbids for new code ("Return values — name them with dataclasses, not tuples"). The #516 review flagged the newly-added snapshot_service instance (NB-1) and noted that fixing it in isolation would diverge from the two grandfathered siblings — so the trio is fixed together here.

What

• New ResolvedProjectCredentials frozen dataclass + shared resolve_project_credentials(config_store, alias) helper in services/base.py (the existing home for cross-service free functions like default_client_factory / sanitize_unexpected_error). This also collapses the previously-triplicated lookup body into one place.
• All three _resolve_project helpers now delegate to the shared function and return the dataclass; call sites read creds.stack_url / creds.token instead of positional unpacking.
• The token_service ConfigError import is dropped (now unused there).

Behavior preserved

• The "Project alias '…' is not registered. Run kbagent project list." ConfigError message is kept verbatim — I deliberately did not switch to the richer ConfigStore.project_not_found_error (issue config.json disappears repeatedly (v0.66.0, macOS) — recurring 'Project not found' #477), to keep behavior identical. That swap could be a separate follow-up if desired.
• No call site changed semantics; the dataclass carries the same two strings.

Scope

Only the three _resolve_project credential helpers. The other pre-existing tuple[str, str] returns in the codebase (http_forwarder_service.resolve_endpoint, project_service.resolve_pinned_alias) are unrelated and stay grandfathered per CONTRIBUTING.md.

Verification

make check clean — 4648 passed, 8 skipped (identical count to the #516 baseline, confirming no tests added/removed and no regressions). ruff + ty clean on all four files. No new tests were needed: the change is a pure return-type refactor with no behavior change, and the existing service/CLI suites (token, stream, snapshot — 98 tests across them) already exercise every converted call site and the unchanged error path.

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.