Sub-issue 3 — UI clouds.yaml credential form

Title: UI: clouds.yaml credential input form

Parent: #1951
Depends on: #1952

Labels (suggested): enhancement, area/ui, area/credentials

Problem

After #1952 lands, the backend accepts clouds.yaml in the credential Secret, but the web UI still exposes only the per-field OS_* form. Non-CLI operators cannot use the new credential format or any auth method beyond username/password.

Proposal

Add a second input mode to the OpenstackCreds creation form, with clouds.yaml as the default tab.

Tab 1 — clouds.yaml (default)

• Textarea for paste plus a file-upload button.
• Client-side YAML parse (js-yaml or already-bundled equivalent).
• On parse success: populate a cloudName dropdown from the top-level clouds: keys.
• On parse failure: inline error with line / column information from the YAML parser.
• Auth-method badge after parse: "Password" for auth_type: v3password, "Application Credential" for auth_type: v3applicationcredential.
• Secret masking: password and application_credential_secret values masked client-side as soon as parse succeeds.
• Submit: write the raw YAML into the Secret as the clouds.yaml key; set cloudName on the OpenstackCreds resource.

Tab 2 — Individual fields (legacy)

• Existing form preserved as a secondary tab.
• Deprecation banner clarifying that newer auth methods are available only via the clouds.yaml tab.

Scope

• New components in ui/src/components/credentials/:
  • OpenstackCredsForm.tsx — tab container.
  • CloudsYamlForm.tsx — clouds.yaml input mode.
  • LegacyOpenStackForm.tsx — extracted from the existing form for cleaner test boundaries (if extraction is required for testability; otherwise leave existing form in place and wrap).
• js-yaml dependency added to ui/package.json only if no YAML parser is already present.
• Existing OpenstackCreds form submission preserved unchanged for the legacy tab.

Acceptance criteria

• Default tab on form open is clouds.yaml; legacy tab accessible as a secondary option.
• Valid clouds.yaml parses and populates the cloud-name dropdown with entries from the YAML.
• Single-entry YAML disables the dropdown (informational); multi-entry enables it.
• Invalid YAML produces an inline parse error with sufficient detail (e.g., line/column) to locate the problem.
• Auth-method badge displays after parse: "Password" or "Application Credential".
• Secret values (password, application_credential_secret) masked after parse; not displayed verbatim in the post-parse summary.
• Submit creates a Secret containing clouds.yaml and an OpenstackCreds resource with cloudName matching the selected entry.
• Legacy form remains visually unchanged and submits the existing OS_*-keyed Secret format.
• Component tests cover tab switching, parse success / failure, cloud-name dropdown population, auth-method badge, masking behavior.
• Manual end-to-end exercise against a development build with Accept clouds.yaml in OpenstackCreds Secret #1952 merged: paste a real clouds.yaml, submit, verify cluster state.

Open questions for maintainers

• Confirm UI build pipeline (Vite) tree-shakes js-yaml to the minimal load surface so the bundle impact is contained.
• File-upload size cap: 1 MB is generous for any realistic clouds.yaml. Confirm or set lower.
• Auth-method badge styling: lean toward encouraging Application Credentials (e.g., green/success color for that badge, neutral for password) or keep both neutral. Recommend the former for soft nudge.
• Deprecation banner copy on the legacy tab: confirm wording.

Branch name

1954-ui-clouds-yaml-form (matches repo convention); branched off main after #1952 merges.