docs: Credential architecture internals documentation

[gladjohn]

Summary

Adds docs/design/credential-architecture.md — an internal architecture doc explaining how credentials are loaded, resolved, and wired to MSAL at runtime.

This is intended for contributors and anyone extending the credential system. The existing credentials-README.md covers the user-facing 'which credential to pick' perspective; this doc covers the internals.

What's covered

• High-level flow — CredentialsProvider → DefaultCredentialsLoader → ICredentialSourceLoader (Mermaid flowchart)
• Key interfaces — ICredentialsLoader, ICredentialSourceLoader, ICredentialsProvider, ICustomSignedAssertionProvider with defining vs implementing assemblies
• All 9 built-in credential source loaders — table mapping CredentialSource enum → loader class → output
• CredentialDescription lifecycle — Initial → Loaded / Skipped state transitions
• Token binding (Bearer vs mTLS PoP) — how isTokenBinding flows through, with the real null-safe TryGetValue code
• Credential wiring to MSAL — full decision tree in WithClientCredentialsAsync()
• Extension points — how to add new ICredentialSourceLoader or ICustomSignedAssertionProvider
• Credential fallback chain — ordered array semantics, Skip behavior, ResetCredentials()
• End-to-end sequence diagrams — FIC+MI Bearer and Certificate mTLS PoP scenarios (Mermaid sequence diagrams)
• Summary matrix — credential type × token type compatibility

Verification

All content verified against current codebase (commit 57860b3). Reviewed for accuracy against TokenAcquisition.cs, CredentialsProvider.cs, DefaultCredentialsLoader.cs, ConfidentialClientApplicationBuilderExtension.cs, and all loader implementations.

Type of change

• Documentation only (no code changes)