Make credential secret names configurable in claude-dev.sh (#150)

[nightjarrr]

Summary

Closes nightjarrr/adda-dev-runtime#31.

• Adds a third keyring attribute, key, so multiple credentials can coexist under the same service/account namespace — unblocking simultaneous per-repo claude-dev.sh sessions (each with a single-repo-scoped GitHub token).
• service stays hardcoded as claude-dev. account values are renamed to identify the target system (github, claude, deepseek); key identifies the credential within that system and is configured per-repo in claude-dev.env.
• Adds CLAUDE_DEV_KEYRING_GITHUB_KEY, CLAUDE_DEV_KEYRING_CLAUDE_KEY, CLAUDE_DEV_KEYRING_DEEPSEEK_KEY to scripts/claude-dev.env (all require_var-validated, fail-fast on missing).
• Updates docs/CLAUDE-DEV-ENVIRONMENT.md (schema table, bootstrap snippets, retrieval snippet) and docs/CURRENT-STATE.md config-variable list to match.

Out of scope / deferred

• The launcher continues to wire up one auth shape per account (GitHub: token, Claude: OAuth, DeepSeek: API key). The schema permits future multi-auth-type support; selection logic is not added here.
• Stale "The launcher retrieves both tokens" sentence in CLAUDE-DEV-ENVIRONMENT.md (now three credentials) is deferred to a follow-up docs chore.
• One-time keyring migration (old account=github-token etc. → new three-attribute form) is performed by PO post-merge via an ad-hoc helper; not committed.

Test plan

• bash -n scripts/claude-dev.sh (Coder, static)
• Visual consistency check: keyring_lookup signature ↔ three call sites ↔ env vars ↔ doc snippets (Coder, static)
• Quality gates (ruff check --fix, ruff format, pytest) — PASS
• PO runs the launcher with one _KEY var temporarily removed and confirms fail-fast error (live, requires Docker/tmux/secret-tool/keyring — outside Coder's environment)
• PO migrates existing keyring entries with the one-time helper, then launches claude-dev.sh end-to-end against the molim repo