feat(fc3b): extension_api_key endpoints + create_app bootstraps credential key

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/__init__.py

@@ -1,18 +1,27 @@
 """Quart app factory."""
 
 import logging
+from pathlib import Path
 
 from quart import Quart
 
 from .api import all_blueprints
 from .config import get_config
 from .frontend import frontend_bp
+from .services.credential_crypto import CredentialCrypto
+
+
+_CREDENTIAL_KEY_PATH = Path("/images/secrets/credential_key.b64")
 
 
 def create_app() -> Quart:
     cfg = get_config()
     logging.basicConfig(level=cfg.log_level)
 
+    # Bootstrap the credential encryption key file (mode 0600) before
+    # any request can land. FC-3b: file-based system-generated key.
+    CredentialCrypto(_CREDENTIAL_KEY_PATH)
+
     app = Quart(__name__)
     app.secret_key = cfg.secret_key