feat(security): encrypt sensitive settings at rest (Fernet)

Secrets (smtp.password, oidc.client_secret, ldap.bind_password, ansible
ssh_private_key/become_password/vault_password) were stored plaintext in
app_settings. Add transparent encryption-at-rest:

- steward/core/crypto.py: Fernet keyed off the app secret (/data/secret.key),
  enc:v1: prefix marks ciphertext; passthrough for plaintext/empty/no-key,
  never reveals plaintext on a wrong key.
- settings.py: SECRET_KEYS registry; set_setting encrypts on write; all read
  paths (get_setting / get_all_settings / load_settings_sync) decrypt
  transparently; migrate_plaintext_secrets() converts legacy rows in place.
- app.py startup: init_crypto(SECRET_KEY) + one-time legacy-secret migration
  before settings load.
- Add cryptography dependency.

UI masking is unchanged (it checks decrypted truthiness). Key-loss caveat
documented: secrets are unrecoverable if the app secret key is lost. Unit
tests cover round-trip, empty/plaintext passthrough, and wrong-key safety.

Task #580.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/app.py

@@ -47,6 +47,13 @@ def create_app(
             plugin_dirs=[Path(d).resolve() for d in app.config["PLUGIN_DIRS"]],
         )
 
+    # ── 3b. Encryption-at-rest: bind the encryptor, then encrypt legacy secrets ─
+    if not testing:
+        from .core.crypto import init_crypto
+        from .core.settings import migrate_plaintext_secrets
+        init_crypto(app.config["SECRET_KEY"])
+        migrate_plaintext_secrets(app.config["DATABASE_URL"])
+
     # ── 4. Load all settings from DB → populate app.config ────────────────────
     if not testing:
         from .core.settings import (