[littlegrasscao]

Summary

• add Delta Sharing POST /shares/{share}/schemas/{schema}/tables/{table}/temporary-table-credentials to OpenSharingProtocolService
• vend catalog storage credentials, as the share owner, in the protocol credentials JSON (awsTempCredentials / azureUserDelegationSas / gcpOauthToken / r2Credentials) for tables with dir access
• the body is optional; its location must be the table root or one of its auxiliary locations
• credential lifetime is the catalog's default (CredentialRequest.ttl null), rather than a new server setting
• StorageCredentials.covers(location) replaces the prefix check the kernel kept privately
• a catalog response missing required keys is a catalog error, not a client error

Testing

• mvn clean install: 159 tests passed
• ProtocolTableCredentialsTest: placeholder AWS credentials for the table root with no body, explicit root location, schema-grant child, malformed body, location outside the table, ungranted share
• TemporaryCredentialsTest maps AWS, Azure, GCP, and R2 credentials

Stacked on #106.