fix(broker): resolve dynamic secrets through the MITM proxy (#269)

## Problem

Proxied requests for an Infisical **dynamic** credential failed with
`credential_not_found` (502) even though the credential was visible in
the credentials table. Static credentials worked; dynamic ones did not.

Root cause is an initialization-ordering bug:

- `attachMITMIfEnabled` calls `srv.CredentialProvider()` and bakes the
returned provider into the MITM proxy **once, at attach time**
(`cmd/server.go`).
- The old `CredentialProvider()` only set `Dynamic` if
`s.infisicalDynamic != nil` *at that instant*.
- But `s.infisicalDynamic` is built later, inside `srv.Start()`.

So the proxy snapshotted a nil dynamic resolver and skipped dynamic
resolution for the whole process lifetime. The UI's enumerate/reveal
path reads `s.infisicalDynamic` live, which is why the credential still
showed up in the table. That asymmetry was the symptom.

## Fix

Bind the resolver through a small `lateDynamicResolver` adapter that
reads `s.infisicalDynamic` **per request** instead of snapshotting it.
Static and dynamic credentials now resolve identically regardless of
attach/`Start` ordering.

The adapter satisfies the existing `Dynamic DynamicCredentialResolver`
interface field, so:
- `brokercore` gains no new public surface (it is unchanged).
- The init-ordering concern lives entirely in the server package, where
the lifecycle problem is.
- The previous typed-nil guard is no longer needed (the adapter is
always a valid non-nil value and handles a nil `infisicalDynamic`
internally).

## Tests

- `TestCredentialProvider_LateBindsDynamicResolver`: captures the
provider while `infisicalDynamic` is nil (the attach-time condition),
asserts the adapter is wired to the live `*Server` and is nil-safe
pre-bind, then assigns the resolver as `Start()` does and confirms the
already-captured provider reaches it.
- Existing `TestInject_DynamicFallback_*` brokercore tests continue to
cover the `Dynamic` path unchanged.

`go build ./...`, `go vet`, and `go test ./...` all pass.

## Scope

Internal bugfix to credential brokering. No agent-facing API, CLI flag,
or env var changes, so no doc/skill updates are needed.