feat: secure BigQuery connection credentials

[debba]

Summary

• hide connection fields that BigQuery does not use and relabel Database as GCP Project ID
• store plugin-owned credentials through the Tabularis OS keychain integration
• keep Password as a fallback for connections created by older Tabularis versions
• replace the handwritten JavaScript extension with React and TypeScript sources built by Vite
• build, typecheck, and package the generated UI bundle in CI and release workflows

Compatibility

This change does not require migration of existing connections. The driver reads the new secure credential extra first and falls back to the existing Password value when it is absent.

Older hosts ignore the additive connection_fields manifest property. When the secure secret API is unavailable, the UI continues to direct users to Password.

Validation

• pnpm --dir ui install --frozen-lockfile
• pnpm --dir ui typecheck
• pnpm --dir ui build
• cargo test --all-targets
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo build --release
• JSON-RPC initialize smoke test
• release archive content verification

Dependencies

Publishing this manifest requires the corresponding Tabularis host support in TabularisDB/tabularis#629 and an update to the Tabularium driver schema so that connection_fields is accepted by the registry validator.

Closes #1