Disable Save Changes when API credentials empty or invalid

[TLabutis]

Summary

• Disables the Save Changes button on the API Credentials tab when the active environment's username or password is empty, when the debounced credential check is still in flight, or when an inline "Invalid credentials" error is shown.
• Marks JSON API Username / JSON API Password as required (red asterisk + aria-required="true") so the requirement is clear before the user clicks Save.

Why

Surfaced during SL-351 testing (TC-351.5): submitting the form with an empty JSON API Username silently saved an empty string to SAFERPAY_USERNAME[_TEST] and a NULL SAFERPAY_CUSTOMER_ID[_TEST], with no validation message. The terminal-fetch endpoint already shows a single inline credential error for invalid formats, so disabling the Save action avoids a duplicate toast on top of that inline message.

Test plan

• Open Settings → API Credentials, clear JSON API Username → Save Changes is disabled
• Clear JSON API Password → Save Changes is disabled
• Enter an invalid username (e.g. asdasasd) with any password → inline "Invalid credentials" error shown, Save Changes disabled, no duplicate toast
• Enter valid username/password → after debounce check, Save Changes enabled, save succeeds
• Repeat all four steps in Live environment

[gemini-code-assist]

Code Review

This pull request improves the API credentials configuration UI by adding required field indicators and accessibility attributes to the username and password inputs. It also updates the 'Save Changes' button logic to prevent submission when credentials are missing, invalid, or being validated. Feedback suggests closing a 1000ms debounce window where the button remains enabled after a field change but before validation starts, by updating the credential status to 'checking' immediately within the input change handlers.

[gemini-code-assist]

The disabled logic correctly prevents saving when credentials are known to be invalid or are currently being checked. However, there is a 1000ms window (the debounce period defined in the useEffect) where the button remains enabled after a user modifies a previously valid field but before the validation status updates to checking.

This allows a user to click 'Save' with potentially invalid credentials if they are quick. While the backend likely handles validation, you might consider updating the credentialStatus to checking immediately within the onChange handlers of the username and password fields to close this gap and provide immediate visual feedback to the user.