feat: stored credentials are sealed at rest, so a copy of the database alone reveals none of them (#6767)

Minstrel keeps credentials it has to read back: indexer, Prowlarr and
download-client keys and passwords, the AcoustID key, cover-art and tag
provider keys, the SMTP password, and each user's ListenBrainz token and
Subsonic password. They were stored in the clear; they are now sealed with
AES-256-GCM under a per-column HKDF key derived from the stream secret, each
value bound to its row.

- internal/secret: Seal/Open/Reveal, and Columns, the one list of sealed
  columns (a backup will leave them out). Install takes the master key at
  startup; SealStored seals any value still in the clear, so an existing
  database is brought over in place on the first boot.
- Every write seals and every read opens: acquire (one read path, getService
  / usableServices), acoustid settings, SMTP, ListenBrainz, Subsonic auth and
  password generation, cover-art and tag provider settings.
- A value that does not open (the stream secret changed) is logged and reads
  as unset, to be entered again in Settings. docs/security.md says so.
- Tests: secret unit tests (wrong owner/purpose/key, malformed, no key), a
  SealStored integration test over all eight columns plus a schema check that
  each listed column exists, and the existing tests now assert sealed storage.
  dbtest installs a test key for integration tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security.md

@@ -49,22 +49,42 @@ cross-origin preflight. Requests authenticated with a bearer token or the
 Subsonic query parameters carry nothing a browser attaches on its own, so
 they aren't checked.
 
-## Subsonic sign-in, and the one password stored in plain text
+## Credentials Minstrel has to read back
+
+Some credentials can't be hashed, because Minstrel has to send or compare the
+value itself:
+- the API keys and passwords for indexers, Prowlarr and download clients;
+- the AcoustID key, and the cover-art and tag provider keys;
+- the SMTP password;
+- each user's ListenBrainz token and Subsonic password.
+
+These are encrypted in the database (AES-256-GCM). Each column has its own key,
+derived from the stream secret (`MINSTREL_STREAM_SECRET`, or the
+`stream_secret` file in the data directory), and each value is bound to its
+row. The stream secret is never stored in the database, so a copy of the
+database alone doesn't reveal any of them. None of them is ever sent back to a
+browser: Settings only shows whether one is set.
+
+**Keep the stream secret with the data directory, and don't change it
+casually.** If it changes, every stored credential reads as not set, and each
+one has to be entered again in Settings (Subsonic passwords generated again).
+Minstrel logs a warning for each one that no longer opens.
+
+## Subsonic sign-in
 
 Classic Subsonic clients sign in with `t` and `s`: the MD5 of the password
 followed by a random salt. To check that, the server has to know the password
 itself, so supporting this sign-in method means storing a password Minstrel
-can read. That is the Subsonic password, and it is the only credential
-Minstrel keeps unhashed.
+can read: the Subsonic password, encrypted as described above.
 
 - **The recommended way in is the API key.** Clients that support the
   OpenSubsonic `apiKey` should use it. The key is stored hashed and can be
   replaced at any time in Settings.
 - **The Subsonic password is never your login password.** Minstrel generates
   it (**Settings → Subsonic password**), shows it once, and lets you replace
-  or turn it off. Because it is random, a copy of the database exposes access
-  to this server's Subsonic API and nothing else: it can't be a password you
-  also use somewhere else.
+  or turn it off. Because it is random, even someone holding both the database
+  and the stream secret gains access to this server's Subsonic API and nothing
+  else: it can't be a password you also use somewhere else.
 - **`t`/`s` and `p=` sign-in are off for an account until it has a Subsonic
   password.** Plain `p=` sign-in is additionally off server-wide unless
   `subsonic.allow_plaintext_password` is enabled.