docs(openspec): add FN-007 Git Connection Model change

- Add proposal, design, specs, and tasks for git connection model
- Include provider adapter, credential storage, SSH key lifecycle specs
- Add repository connection API and git operations specifications

openspec/changes/git-connection-model/specs/credential-storage/spec.md

@@ -0,0 +1,30 @@
+## ADDED Requirements
+
+### Requirement: Credentials are stored encrypted
+The system SHALL store access tokens and SSH keys encrypted at rest.
+
+#### Scenario: Store access token
+- **WHEN** a user saves an access token
+- **THEN** the system encrypts it with Fernet
+- **AND** stores the encrypted value in the database
+
+#### Scenario: Retrieve access token
+- **WHEN** the system retrieves a credential for API calls
+- **THEN** it decrypts the value
+- **AND** returns the plaintext token
+
+#### Scenario: List credentials without exposing values
+- **WHEN** a user lists their credentials
+- **THEN** the system returns metadata (name, provider, created_at)
+- **AND** masks the token value (showing only last 4 characters)
+
+### Requirement: Credential storage supports multiple providers
+The system SHALL support storing credentials for different Git providers.
+
+#### Scenario: Store GitHub token
+- **WHEN** a user adds a GitHub personal access token
+- **THEN** the system stores it with provider_type="github"
+
+#### Scenario: Store GitLab token
+- **WHEN** a user adds a GitLab personal access token
+- **THEN** the system stores it with provider_type="gitlab"