chore(api): inject the vault dependency into the starter-credits bridge

[mmabrouk]

What

ee.src.core.starter_credits_bridge.service builds its own vault dependency:

def _vault_service() -> VaultService:
    return VaultService(SecretsDAO())

The repo's coding guidelines say core services depend on interfaces (*DAOInterface), not on concrete database implementations, and that concrete dependencies are wired in api/entrypoints/* only. The bridge should take a vault interface instead, with the concrete DAO wired at an entrypoint.

Why it is filed rather than fixed

Raised by CodeRabbit on #6723 (comment), which was a production hot fix for a stale starter-credits model. _vault_service() predates that pull request. It has been the seeding path's dependency since the bridge shipped, and the hot fix only added two more call sites of the existing helper. Reshaping the bridge's construction and rewiring the entrypoints is a structural change with its own blast radius, so it did not belong in a hot fix.

Scope

• Give the bridge service an injected vault dependency, typed against the interface rather than VaultService.
• Wire the concrete VaultService(SecretsDAO()) in api/entrypoints/*.
• Cover the seeding path and the read-path repair, which are the two callers today.
• The seeding tests already stub the helper with monkeypatch.setattr(service, "_vault_service", ...). Injection should let them pass a fake in directly.

[linear-code]

AGE-4314