feat: stored credentials are sealed at rest, so a copy of the database alone reveals none of them (#6767)

Minstrel keeps credentials it has to read back: indexer, Prowlarr and
download-client keys and passwords, the AcoustID key, cover-art and tag
provider keys, the SMTP password, and each user's ListenBrainz token and
Subsonic password. They were stored in the clear; they are now sealed with
AES-256-GCM under a per-column HKDF key derived from the stream secret, each
value bound to its row.

- internal/secret: Seal/Open/Reveal, and Columns, the one list of sealed
  columns (a backup will leave them out). Install takes the master key at
  startup; SealStored seals any value still in the clear, so an existing
  database is brought over in place on the first boot.
- Every write seals and every read opens: acquire (one read path, getService
  / usableServices), acoustid settings, SMTP, ListenBrainz, Subsonic auth and
  password generation, cover-art and tag provider settings.
- A value that does not open (the stream secret changed) is logged and reads
  as unset, to be entered again in Settings. docs/security.md says so.
- Tests: secret unit tests (wrong owner/purpose/key, malformed, no key), a
  SealStored integration test over all eight columns plus a schema check that
  each listed column exists, and the existing tests now assert sealed storage.
  dbtest installs a test key for integration tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/coverart/settings.go

@@ -13,6 +13,7 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/secret"
 )
 
 // SettingsService reconciles the registry of compiled-in providers
@@ -112,7 +113,7 @@ func (s *SettingsService) reconcile(ctx context.Context) error {
 		}
 		key := ""
 		if row.ApiKey != nil {
-			key = *row.ApiKey
+			key = secret.Reveal(secret.CoverArtAPIKey.Purpose(), row.ProviderID, *row.ApiKey)
 		}
 		s.enabledIDs[p.ID()] = row.Enabled
 		s.apiKeys[p.ID()] = key
@@ -204,11 +205,15 @@ func (s *SettingsService) UpdateProvider(ctx context.Context, providerID string,
 	// (apiKeyChanged flag) and $4 (api_key value). The actual generated
 	// field for $4 is ApiKey *string.
 	apiKeyChanged := patch.APIKey != nil
+	sealedKey, err := secret.SealPtr(secret.CoverArtAPIKey.Purpose(), providerID, patch.APIKey)
+	if err != nil {
+		return false, fmt.Errorf("seal provider api key: %w", err)
+	}
 	if err := q.UpdateProviderSettings(ctx, dbq.UpdateProviderSettingsParams{
 		ProviderID: providerID,
 		Enabled:    enabledVal,
 		Column3:    apiKeyChanged,
-		ApiKey:     patch.APIKey,
+		ApiKey:     sealedKey,
 	}); err != nil {
 		return false, fmt.Errorf("update provider settings: %w", err)
 	}
@@ -225,7 +230,7 @@ func (s *SettingsService) UpdateProvider(ctx context.Context, providerID string,
 	for _, r := range rows {
 		key := ""
 		if r.ApiKey != nil {
-			key = *r.ApiKey
+			key = secret.Reveal(secret.CoverArtAPIKey.Purpose(), r.ProviderID, *r.ApiKey)
 		}
 		s.enabledIDs[r.ProviderID] = r.Enabled
 		s.apiKeys[r.ProviderID] = key