fix: credential data corruption - Create handler mutating store pointer

- CreateCredential was setting cred.Data = cred.Masked directly on the
  store pointer, corrupting stored credentials with masked data
- Fixed by using a value copy for API response
- Also fix nextID starts at 1 to avoid ID=0 issue

backend/handlers/credential.go

@@ -89,9 +89,10 @@ func (h *CredentialHandler) CreateCredential(c *gin.Context) {
 		return
 	}
 
-	// Return without secrets
-	cred.Data = cred.Masked
-	c.JSON(http.StatusCreated, cred)
+	// Return without secrets (use a copy to avoid mutating store)
+	resp := *cred
+	resp.Data = cred.Masked
+	c.JSON(http.StatusCreated, &resp)
 }
 
 // UpdateCredential updates a credential