[varunj-msft]

Description

Part 19 of saving Registry entries across restarts. A side branch stacked on part 9 (#4027), with part 17 (#3984) merged in as the first commit; nothing builds on it. This PR's own changes: varunj-msft/PyRIT@8c19cc7...varunj-msft/13178-Server-Credentials

Design: 4.4 Credentials, 5. How an admin sets up credentials. Where every part fits: PR map.

This is one of the changes for saving Registry entries across restarts. Until the earlier PRs merge, the diff here also shows their changes.

A saved target can't hold a key, so a target that needs an API key could only be Temporary. An administrator can now list keys from the server's environment that users pick by name, each tied to the only endpoint it is sent to.

• .pyrit_conf takes server_credentials: a list of entries with a name users pick, the env_var that holds the key, and the endpoint the key is sent to. Each name can be listed once. The endpoint must be a full http(s) address with no user name, password, query or fragment.
• GET /api/targets/types lists each credential's name and endpoint for the types that can use one (the OpenAI targets for now), never the variable or the key.
• POST /api/targets takes "server_credential": "<name>" with auth_mode api_key and no api_key of its own, and not with source (422 otherwise). The key is used only when the target's endpoint is the credential's endpoint, compared with the scheme and host lowercased and a default port and trailing slash removed. A credential that isn't listed or set, or another endpoint, gets a 400.
• A saved target stores the credential's name, never the key, and reads the key again at every start, so a rotated value takes effect at the next start. Restore refuses a saved target whose credential is no longer listed or set.
• The New Target dialog offers Server credential as an authentication choice when the type has one. Picking one sets the endpoint to the credential's endpoint, read-only, sends the name with no key, and lets the target be saved.
• .pyrit_conf_example, doc/getting_started/pyrit_conf.md, the backend README and the GUI doc describe the setting. They say to list a variable that holds only that key: a variable a target reads on its own, such as OPENAI_CHAT_KEY, can still reach any endpoint through a Temporary target created without a key.

What stays the same: without server_credentials in .pyrit_conf, nothing changes; the types list has empty lists and the dialog offers no new choice. A typed key still makes a Temporary target, and a Temporary target without a key still uses this server's own key variable, as the backend README describes.

Screenshots: the New Target dialog with Server credential chosen, and the saved target in the Targets table.

Not covered:

• Other target types that take keys, such as Azure ML and Prompt Shield, can use the same list later. Converters and scorers don't use it yet.
• Keys for each caller are FEAT: Support personal tokens with per-caller target credentials #4024.