Snapshot export always emits an encrypted credentials block, even with nothing to encrypt #8571

POST /api/v1/snapshots/:id/export on a snapshot with no flows and no credentials still comes back with "credentials": { "$": "d872ccff1081e99022fcc04d8f0fd6eeccM=" }, which is an encrypted empty object. exportSnapshot calls exportCredentials unconditionally and encryptCreds wraps whatever it's given.

Harmless in itself, but it makes every export look like it holds secrets, and anything importing an export then has to supply a credentialSecret whatever the snapshot actually contains.

Might be worth leaving credentials as {} when there's nothing to encrypt.