feat(523): forge-connection tokens are stored sealed under SECRET_KEY, like the backup S3 secret

The column becomes token_sealed (migration 0122 seals existing rows with a
frozen copy of the v1 key), every reader opens it through connection_token,
a row this instance cannot open is skipped with a warning, and Settings asks
for that token again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/scribe/services/forge_connections.py

@@ -4,7 +4,9 @@ A connection is a user's read-only credential for one forge host; one row per
 (user, host) keeps host-keyed resolution deterministic with no default-pointer
 machinery. Everything here is own-rows-only: a connection is a credential, and
 no caller — admin included — reads or edits another user's. The token never
-leaves the server (model.to_dict omits it; routes mask "set/unset").
+leaves the server (model.to_dict omits it; routes mask "set/unset"), and it is
+stored sealed (services/secrets.py): a copy of the database alone cannot read
+it. Every reader opens it through `connection_token`.
 
 Validation matches what build_adapter will accept, checked here so a bad
 value is a 400 at the form instead of a silently dead keyring row.
@@ -17,6 +19,14 @@ from scribe.models import async_session
 from scribe.models.forge_connection import ForgeConnection
 from scribe.models.project import Project
 from scribe.services.forge import FORGE_KINDS, host_of
+from scribe.services.secrets import seal, unseal
+
+
+def connection_token(row: ForgeConnection) -> str | None:
+    """The connection's token in the clear, or None when this instance can't
+    open it — sealed under a different SECRET_KEY (a restore onto a new
+    instance, a rotated key). The owner enters it again; nothing else can."""
+    return unseal(row.token_sealed)
 
 
 def validate_connection(kind: str, base_url: str) -> str | None:
@@ -82,7 +92,8 @@ async def create_connection(
                 "resolution is by host, so a second row could never be reached"
             )
         row = ForgeConnection(
-            user_id=user_id, kind=kind, base_url=base_url, host=host, token=token
+            user_id=user_id, kind=kind, base_url=base_url, host=host,
+            token_sealed=seal(token),
         )
         session.add(row)
         await session.commit()
@@ -135,7 +146,7 @@ async def update_connection(
         row.base_url = new_base
         row.host = new_host
         if token:
-            row.token = token
+            row.token_sealed = seal(token)
         await session.commit()
         await session.refresh(row)
         return row