feat(security): encrypt sensitive settings at rest (Fernet)

Secrets (smtp.password, oidc.client_secret, ldap.bind_password, ansible
ssh_private_key/become_password/vault_password) were stored plaintext in
app_settings. Add transparent encryption-at-rest:

- steward/core/crypto.py: Fernet keyed off the app secret (/data/secret.key),
  enc:v1: prefix marks ciphertext; passthrough for plaintext/empty/no-key,
  never reveals plaintext on a wrong key.
- settings.py: SECRET_KEYS registry; set_setting encrypts on write; all read
  paths (get_setting / get_all_settings / load_settings_sync) decrypt
  transparently; migrate_plaintext_secrets() converts legacy rows in place.
- app.py startup: init_crypto(SECRET_KEY) + one-time legacy-secret migration
  before settings load.
- Add cryptography dependency.

UI masking is unchanged (it checks decrypted truthiness). Key-loss caveat
documented: secrets are unrecoverable if the app secret key is lost. Unit
tests cover round-trip, empty/plaintext passthrough, and wrong-key safety.

Task #580.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/core/test_crypto.py

@@ -0,0 +1,46 @@
+"""Unit tests for settings encryption-at-rest (Fernet)."""
+from steward.core.crypto import (
+    ENC_PREFIX,
+    decrypt_secret,
+    encrypt_secret,
+    init_crypto,
+    is_encrypted,
+)
+
+
+def setup_function():
+    init_crypto("unit-test-secret-key")
+
+
+def test_roundtrip():
+    tok = encrypt_secret("hunter2")
+    assert tok.startswith(ENC_PREFIX)
+    assert tok != "hunter2"
+    assert is_encrypted(tok)
+    assert decrypt_secret(tok) == "hunter2"
+
+
+def test_empty_passes_through():
+    assert encrypt_secret("") == ""
+    assert is_encrypted("") is False
+
+
+def test_plaintext_decrypt_passthrough():
+    assert decrypt_secret("not-encrypted") == "not-encrypted"
+
+
+def test_is_encrypted_type_guard():
+    assert is_encrypted(encrypt_secret("x")) is True
+    assert is_encrypted("plain") is False
+    assert is_encrypted(None) is False
+    assert is_encrypted(123) is False
+
+
+def test_wrong_key_does_not_reveal_plaintext():
+    init_crypto("key-A")
+    tok = encrypt_secret("secret")
+    init_crypto("key-B")
+    # Wrong key -> InvalidToken -> token returned unchanged, never the plaintext.
+    assert decrypt_secret(tok) != "secret"
+    init_crypto("key-A")
+    assert decrypt_secret(tok) == "secret"