fix(backend): the missing-credentials card loads the same credentials and grant list three times

Building the missing-credentials card loads the same account credentials and grant list up to three times.

On the card path in run_agent.py:708, match_user_credentials_to_graph already resolves the user's credentials, and then annotate_expert_grants and ungranted_credential_hint each fetch them again — annotate_expert_grants through _ungranted_credentials, which calls store.get_all_creds(user_id) and expert_allowed_credential_ids(user_id, expert_id) (copilot/tools/expert_scope.py:194-213), and the hint independently. Three loads of the same two lists per card build.

Off the hot path, as the review that found it says: this runs when a card is being rendered because something was missing, not on every execution. But it is the same data, fetched three times, in the path a user is already waiting on.

The fix is to resolve the owned credentials and the allowed-id set once where the card is built and pass them into both helpers, rather than having each helper reach for them. Both already take an expert id and could take the resolved sets instead.

Found by the autoreviewer on #14417 (approved, 0 blockers). Related: #14610, which is the same shape one layer down — expert_allowed_credential_ids eager-loading a workflow join it discards.