Support mooseRuntimeEnv.get() for dictionary external source credentials (#3954)

## Summary

- Extends `resolve_runtime_credentials_from_env()` in
`InfrastructureMap` to resolve `__MOOSE_RUNTIME_ENV__` markers in
dictionary external source credential fields
- Covers all credentialed sources: ClickHouse, MySQL, PostgreSQL, Redis,
MongoDB, and S3
- Uses the same `resolve_runtime_env` / `resolve_optional_runtime_env`
infrastructure already used for S3Queue/S3/IcebergS3 table engines

## Motivation

ClickHouse Cloud does not support named collections, so dictionary
sources require inline `user`/`password` credentials in the DDL. Without
this change, users had no way to avoid hardcoding secrets. With this
change, they can write:

```typescript
OlapDictionary("my_dict", {
  source: {
    clickhouse: {
      host: "ch.cloud.example.com",
      user: mooseRuntimeEnv.get("CH_DICT_USER"),
      password: mooseRuntimeEnv.get("CH_DICT_PASSWORD"),
      ...
    }
  }
})
```

## Test plan

- [x] 8 unit tests added covering all 6 credentialed source types plus
error and passthrough cases
- [x] `cargo clippy --all-targets -- -D warnings` clean
- [x] All existing dictionary tests continue to pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Touches credential-resolution logic for ClickHouse external
dictionaries (including error reporting) and adjusts masking/comparison
semantics; mistakes could break deployments or leak/ignore credential
changes. Changes are well-covered by new regression/unit tests, reducing
risk.
> 
> **Overview**
> Adds runtime resolution of `__MOOSE_RUNTIME_ENV__` markers for
**external-source ClickHouse dictionaries**
(ClickHouse/MySQL/Postgres/Redis/MongoDB/S3) in
`InfrastructureMap::resolve_runtime_credentials_from_env`, enabling
`mooseRuntimeEnv.get()` for dictionary credentials.
> 
> Clarifies and enforces credential-masking semantics: **secrets are
masked but usernames remain plaintext** so username changes trigger
dictionary rebuilds/diffs; expands drift detection normalization to
ignore dictionary `metadata` and password-only differences to avoid
false drift.
> 
> Adds extensive regression/unit tests covering dictionary env
resolution, masking behavior, diff detection for username changes, and
drift detection ignoring metadata-only differences.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
9689a57. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Benoit Aubuchon

apps/framework-cli/src/cli/routines/migrate.rs

@@ -2232,6 +2232,45 @@ mod tests {
         dict
     }
 
+    // Regression: when expected dict has a source file in its metadata but current has
+    // none, detect_drift must return NoDrift — not DriftDetected — because dict metadata
+    // must be stripped before comparison, just as table metadata is.
+    #[test]
+    fn test_detect_drift_no_false_drift_with_dict_metadata_difference() {
+        use crate::framework::core::infrastructure::table::{Metadata, SourceLocation};
+
+        let tables: HashMap<String, Table> = HashMap::new();
+
+        let mut expected_dict = create_test_dict("my_dict");
+        expected_dict.metadata = Some(Metadata {
+            description: None,
+            source: Some(SourceLocation {
+                file: "/old/path/my_dict.ts".to_string(),
+            }),
+        });
+        let mut expected_dicts = HashMap::new();
+        expected_dicts.insert("my_dict".to_string(), expected_dict);
+
+        // current and target have no metadata (metadata stripped after introspection / runtime)
+        let mut current_dicts = HashMap::new();
+        current_dicts.insert("my_dict".to_string(), create_test_dict("my_dict"));
+        let target_dicts = current_dicts.clone();
+
+        let result = detect_drift(
+            &tables,
+            &tables,
+            &tables,
+            &current_dicts,
+            &expected_dicts,
+            &target_dicts,
+            &[],
+        );
+        assert!(
+            matches!(result, DriftStatus::NoDrift),
+            "Metadata-only differences in dicts must not cause false drift"
+        );
+    }
+
     // Regression: when state_before was saved with masked credentials (CREDENTIAL_PLACEHOLDER)
     // but the live infra map has real credentials, detect_drift must return NoDrift — not
     // DriftDetected — because credentials should be normalized out before comparison.