Enterprise: present Image Factory credentials as customer ID + API keys, never expose secrets

[sterlingkoch]

Problem Description

Enterprise Omni currently presents Enterprise Image Factory credentials as a "username" and "password," with both embedded in plaintext in the download/boot URLs shown in the install-media dialog (visible on staging today). Enterprise customers expect API-key semantics: a secret that is shown once at creation, never displayed again, and rotatable — and they will not accept plaintext credentials in URLs for a product sold on security. This came out of the July 15 planning meeting and is part of TEL September readiness.

The underlying mechanism already mostly supports this — the factory supports multiple keys per account and graceful rotation, and the credential is already redacted in the Talos machine config. This is primarily a presentation and terminology change on the Omni side.

Solution

• Rename throughout the enterprise UI: "username" → customer ID (it's a per-customer identifier, not a person), "password" → API key.
• Never render an API key in clear text anywhere in the UI after creation. If/when a creation flow exists in Omni, show the key once at creation with a "copy it now" pattern.
• Remove embedded credentials from all displayed URLs. Download URLs are replaced by time-based signed URLs (Support time-based signed download URLs #3138, image-factory#498); the PXE option is hidden for enterprise (Hide PXE boot in enterprise Omni #3137).

Alternative Solutions

No response

Notes

• Rotation model discussed in the meeting: a customer can hold multiple API keys; when Omni's own credential is rotated, Omni reconciles the change out to machine configs.
• Out of scope: credential provisioning/rotation backend (ops-managed-siderolabs#3168), the longer-term user database + provisioning API (Spencer's research, RFD 38), and the signed-URL mechanism itself (image-factory#498).

Decided at the July 15 planning marathon