Implement Week 7 Remote Origins with Oracle fixes

- Add credentials.rs with CredentialStore, redacted Debug (session_token shows [REDACTED])
- Add nfs.rs with ESTALE retry using Fn closure, 5s health timeout
- Add smb.rs with ENOTCONN retry handling, 5s health timeout
- Add s3.rs/sftp.rs feature-gated stubs with security documentation
- Add error variants: S3, Sftp, Timeout, Credential, NfsStaleHandle
- Fix delta.rs unused imports

Oracle fixes applied:
- SMB retry_on_disconnect for ENOTCONN (errno 107)
- session_token Debug shows [REDACTED] when Some, None otherwise
- NFS/SMB health checks wrapped with tokio::time::timeout(5s)

102 tests pass, 0 warnings.

musicfs/crates/musicfs-core/src/error.rs

@@ -37,6 +37,31 @@ pub enum Error {
 
     #[error("Origin error: {0}")]
     Origin(String),
+
+    #[error("S3 error: {0}")]
+    S3(String),
+
+    #[error("SFTP error: {0}")]
+    Sftp(String),
+
+    #[error("Operation timed out: {0}")]
+    Timeout(String),
+
+    #[error("Credential error: {0}")]
+    Credential(String),
 }
 
 pub type Result<T> = std::result::Result<T, Error>;
+
+impl Error {
+    pub fn is_not_found(&self) -> bool {
+        matches!(self, Error::FileNotFound(_))
+    }
+
+    pub fn downcast_io(&self) -> Option<&std::io::Error> {
+        match self {
+            Error::Io(e) => Some(e),
+            _ => None,
+        }
+    }
+}