fix: a credential store holds credentials of one kind, without a kind field in its entries, and the dialog edits several stores in tabs.

ADR.md

@@ -57,11 +57,15 @@ Context: sql-query-webui kept PostgreSQL connection profiles with encrypted pass
 manage-ui needs a PostgreSQL connection and an Azure service principal without taking them from
 its environment. Other systems will need other kinds of credentials.
 
-Decision: A credential store is a list in a key of the application's `config.json`; each entry
-has a name, a kind and the fields of its kind. The application gives the kinds as data: each field
-with its key, label, help, type (text, port, GUID or a choice), whether it is required and whether
-it is secret. The toolkit checks the entries, serves read, validate and write routes, and renders
-the dialog from the kinds, so a new kind needs no new code. Secret fields are encrypted with
+Decision: A credential store is a list in a key of the application's `config.json`, all of one
+kind; each entry has a name and the fields of the store's kind, and no kind of its own, as the key
+of `config.json`, whose schema the application defines, already says what the entries are. An
+application with several kinds of credentials has a store, a key, for each. The application gives
+the kind as data: each field with its key, label, help, type (text, port, GUID or a choice),
+whether it is required and whether it is secret. The toolkit checks the entries, serves read,
+validate and write routes, and renders the dialog from the kind, so a new kind needs no new code;
+the dialog edits the stores of one `config.json` in tabs, and its Save writes them one after the
+other, each with the version the previous write answers. Secret fields are encrypted with
 AES-256-GCM, a random 12-byte IV each, with the key the SHA-256 of `ENCRYPTION_KEY`, else of the
 content of `ENCRYPTION_KEY_FILE`. A secret is never answered: read gives null and whether it is
 kept, and a write sends null to keep it, `''` to drop it, or a new secret. The applications decide