feat: advance database and Herdr pilots

docs/plans/credential-consolidation.md

@@ -71,15 +71,19 @@ indefinitely.
 - `yookr-workbench` decrypts once in memory and exports only its API login, four
   database connections, Irristaud S3 credential, and test RabbitMQ credential.
 - Central test API login and the read-only RabbitMQ overview passed.
-- MySQL test/live `SELECT 1` and MongoDB test/live `ping` passed. The MongoDB
-  endpoints publish SRV rather than direct address records and therefore use
-  `mongodb+srv` URLs.
+- MariaDB test/live example queries and MongoDB test/live example scripts passed.
+  Both MariaDB sessions negotiated TLS 1.3. The routers expose auto-generated
+  certificates from unavailable private CAs without valid host identities, so
+  only these two URLs disable certificate verification. The MongoDB endpoints
+  publish SRV rather than direct address records and therefore use `mongodb+srv`
+  URLs.
 - The ephemeral `irristaud:` rclone remote found the sole `irristaud` container
   and listed its six root entries. No object content was downloaded and no
   rclone configuration was persisted.
 
-Dadbod's four display names require activation of the pending Neovim
-configuration and explicit authorization of the changed workbench `.envrc`.
+Dadbod's four display names are active and both MongoDB connections work. The
+changed workbench `.envrc` still needs explicit re-authorization before the user
+visually confirms the MariaDB fix.
 
 ## Excluded from migration
 
@@ -105,5 +109,6 @@ credential is still active.
   the reviewed local contract and work independently.
 - Management accepts an account-issued JWT only as the raw `Authorization` value,
   contrary to its current OpenAPI Bearer declaration.
-- Herdr issue 197 is suitable for a local planning pilot, but the current Codex
-  session is not running inside Herdr and must not control it.
+- The Herdr issue 197 pilot produced local-only frontend and backend planning
+  commits without touching company GitHub. Both identify the separate account
+  service, not `yookr-dashboard`, as the implementation owner.