docs(sandboxes): expand sbx secret import documentation

Add a dedicated subsection covering all import modes: interactive
default, named-service import, --all for non-interactive/CI use,
--force for overwriting existing entries, and --dry-run. Update
the built-in services table heading to explicitly link the env var
column to what secret import reads.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: dvdksn

content/manuals/ai/sandboxes/security/credentials.md

@@ -91,22 +91,49 @@ $ sbx secret set my-sandbox openai
 > you set or change a global secret while a sandbox is running, recreate the
 > sandbox for the new value to take effect.
 
-If you have API keys already set as environment variables in your shell, use
-`sbx secret import` to store them all at once:
+### Import from environment variables
+
+If you already have API keys set in your shell, `sbx secret import` reads them
+and stores them in the keychain without typing each value manually:
 
 ```console
 $ sbx secret import
 ```
 
-This reads recognized environment variables from your current session (such as
-`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GITHUB_TOKEN`, and others from the
-[built-in services table](#built-in-services)) and stores them globally. Run
-`sbx secret ls` to confirm what was imported.
+This scans your current session for the environment variables listed in the
+[built-in services table](#built-in-services) below and prompts you to confirm
+each one before writing it. To import a single service:
+
+```console
+$ sbx secret import openai
+```
+
+For non-interactive use (CI or scripted setup), skip the prompts with `--all`.
+New entries are written without confirmation; existing entries are left
+unchanged:
+
+```console
+$ sbx secret import --all
+```
+
+To overwrite an existing stored entry, add `--force`:
+
+```console
+$ sbx secret import openai --force
+```
+
+To preview what would be imported without writing anything:
+
+```console
+$ sbx secret import --dry-run
+```
+
+Run `sbx secret ls` afterwards to confirm what's stored.
 
 ### Built-in services
 
-Each built-in service name maps to a conventional environment variable name
-and the API domains it authenticates requests to:
+Each built-in service name maps to the environment variable `sbx secret import`
+reads and the API domains the proxy injects credentials into:
 
 | Service      | Environment variables              | API domains                                                                                                                   |
 | ------------ | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
@@ -123,8 +150,7 @@ and the API domains it authenticates requests to:
 | `xai`        | `XAI_API_KEY`                      | `api.x.ai`                                                                                                                    |
 
 When you store a secret with `sbx secret set -g <service>`, the proxy injects
-it into requests to the listed API domains. The environment variable names are
-the conventional names for those credentials, used by `sbx secret import`.
+it into requests to the listed API domains.
 
 ### Services declared by kits