credstore: expose 1Password backends (op / op-connect / op-desktop) #29

Context

ByteNess v1.9.3 ships three 1Password backends (`op` Service Account, `op-connect`, `op-desktop`), all of which route through `github.com/1password/onepassword-sdk-go` which is currently pinned at `v0.4.1-beta.1` (pre-1.0). #24 deliberately deferred these to avoid putting a beta SDK on the credential-access critical path.

Trigger

Reopen this when:

• `onepassword-sdk-go` releases a stable (non-beta) tag, OR
• A user explicitly asks for one of these backends and accepts the beta-SDK risk in writing.

Scope (when picked up)

Mirror the `pass` pattern from #26:

• Add `BackendOPSrvAccount = "op"` (the `op` BackendType in ByteNess is actually the Service Account backend, not the `op` CLI), `BackendOPConnect = "op-connect"`, `BackendOPDesktop = "op-desktop"`.
• Extend `buildKeyringConfig` to populate the required `Config` fields per backend:
  • `op`: `OPVaultID` + `OPTimeout` (both currently sourced from env via the SDK).
  • `op-connect`: `OPConnectHost` + `OPConnectTokenEnv`.
  • `op-desktop`: `OPVaultID` (host is implicit via IPC).
• Decide whether `OPVaultID` should be a credstore Options field or stay env-only (the SDK reads `OP_VAULT` etc. directly).
• Tests: construction tests pinning each backend's required fields, plus `TestSelectBackendNeverAuto` per the `pass` and `memory` pattern.
• Docs: §1.4 explicit-opt-in paragraph + §1.10 rewrite.

Constraints

• Service-scoped item naming: figure out whether ByteNess's op backends honor `ServiceName` (unlike `pass`, which ignores it and required a `PassPrefix` carve-out in feat(credstore): recognize the pass(1) backend #26). If not, add an equivalent prefix mechanism so two CLIs don't collide.
• Adding the SDK as a transitive dep will increase `go.sum`; document the binary-size impact like credstore: expand recognized backend set (pass, keepassxc, 1password, …) #24 deferred to here.

Out of scope

• Anything outside the three op variants.