Resolve Global Variables Endpoint

Resolve all global variables for the team into a {name: value} dict.

UI-facing, so every credential is masked — via resolve_global_variables_split, which classifies on is_secret as well as the system names. The previous _mask_system_secrets masked only the system names, so a team's own variable marked secret came back in clear from this route. Execution services use the internal route below.