bug: agent startup auto-import of .credentials.enc calls a backend route that does not exist, so it always fails silently #3510

Summary

When an agent container starts with a .credentials.enc in its home directory and no .env, docker/base-image/startup.sh tries to auto-import the encrypted credentials by calling POST /api/internal/decrypt-and-inject on the backend. That route does not exist. The call fails, startup prints Warning: Could not auto-import credentials (key may not be configured), and the agent runs without the credentials — with a message that points the operator at the wrong cause.

Context

Found while reviewing #3483 (removal of uncalled internal routes).

• docker/base-image/startup.sh:693 — the curl to http://backend:8000/api/internal/decrypt-and-inject, sent with no internal-secret header.
• src/backend/routers/internal.py — no such handler. A pickaxe over src/backend history (git log -S"decrypt_and_inject") finds no commit that ever added one; the feature commit (6821f0d59, CRED-002) added the request model and the startup.sh call only.
• src/backend/models.py:1517 — InternalDecryptInjectRequest, referenced by nothing.
• Docs describe the route as live, including a handler snippet: docs/memory/architecture/api-endpoints.md:140, docs/memory/feature-flows/credential-injection.md:61 and :301-310.
• startup.sh:713-714 (the .mcp.json.template renderer) states it runs after "both .env sources", counting this fallback as one of them.

So the "portable credentials via a git-committed .credentials.enc" path has not worked at startup since it shipped. Agents whose .env arrives through the /generated-creds mount (startup.sh:530-545) are unaffected; the gap is an agent whose only credential source is the committed encrypted file (for example a github: template that ships one). The manual path — Import from Git on the Credentials tab / import_credentials — works.

Not yet measured: how many real agents hit this branch.

Acceptance Criteria

• Decide: implement the startup auto-import, or remove it. Record the decision here.
• If implemented: an agent that starts with .credentials.enc and no .env ends up with a decrypted .env before the .mcp.json.template render, the call authenticates the way the other agent→backend internal calls do (the internal router is gated by verify_internal_secret), and the route appears in the route census with its gate.
• If removed: the startup.sh block, InternalDecryptInjectRequest, and the comment at startup.sh:713-714 are gone, and startup tells the operator to import from the Credentials tab when it sees .credentials.enc without .env.
• Either way, a failed or absent import is reported with its real cause, not "key may not be configured".
• api-endpoints.md and credential-injection.md match the code.
• A test fails if startup.sh calls a backend path that is not in the route table.

Technical Notes

• Related: refactor: remove API routes nothing calls — five unauthenticated internal routes, two duplicate activity routes — and the orphan observability store #3434 / refactor(api): remove nine uncalled routes and the orphan observability store (#3434) #3483 (corrected the "(no auth)" wording on these doc rows but left the rows), POST /api/credentials/update has no callers but is named as the sanctioned MCP-config path #2008 (listed this call as live).
• The import logic already exists behind the owner-gated import route in src/backend/routers/credentials.py; an internal variant would reuse the same service.