docs: add credential lifecycle guidance

tests/test_interface_documentation_contract.py

@@ -24,7 +24,19 @@ class InterfaceDocumentationContractTests(unittest.TestCase):
                 "access.admin.tenant-roles",
                 "access.admin.api-keys",
                 "access.admin.service-accounts",
+            },
+            "access.workflow.manage-reusable-credentials": {
+                "access.admin.system-credentials",
+                "access.admin.tenant-credentials",
+                "access.admin.group-credentials",
+                "access.admin.user-credentials",
+                "access.settings.credentials",
                 "access.credentials",
+                "access.credentials.field.secret",
+                "access.credentials.field.clear-secret",
+                "access.credentials.field.inherit-to-lower-scopes",
+                "access.credentials.action.delete",
+                "access.credentials.confirm-delete",
             },
             "access.reference.external-function-role-mappings": {
                 "access.admin.function-mappings",
@@ -43,6 +55,16 @@ class InterfaceDocumentationContractTests(unittest.TestCase):
                 topic_id,
             )
 
+        credential_topic = topics["access.workflow.manage-reusable-credentials"]
+        self.assertEqual(
+            {"title", "summary", "body"},
+            set(credential_topic.translations["de"]),
+        )
+        self.assertIn(
+            "nicht rückgängig gemacht",
+            credential_topic.translations["de"]["body"],
+        )
+
     def test_access_admin_surfaces_remain_declared(self) -> None:
         surface_ids = {
             surface.id for surface in manifest.frontend.view_surfaces