feat: stored credentials are sealed at rest, so a copy of the database alone reveals none of them (#6767)

Minstrel keeps credentials it has to read back: indexer, Prowlarr and
download-client keys and passwords, the AcoustID key, cover-art and tag
provider keys, the SMTP password, and each user's ListenBrainz token and
Subsonic password. They were stored in the clear; they are now sealed with
AES-256-GCM under a per-column HKDF key derived from the stream secret, each
value bound to its row.

- internal/secret: Seal/Open/Reveal, and Columns, the one list of sealed
  columns (a backup will leave them out). Install takes the master key at
  startup; SealStored seals any value still in the clear, so an existing
  database is brought over in place on the first boot.
- Every write seals and every read opens: acquire (one read path, getService
  / usableServices), acoustid settings, SMTP, ListenBrainz, Subsonic auth and
  password generation, cover-art and tag provider settings.
- A value that does not open (the stream secret changed) is logged and reads
  as unset, to be entered again in Settings. docs/security.md says so.
- Tests: secret unit tests (wrong owner/purpose/key, malformed, no key), a
  SealStored integration test over all eight columns plus a schema check that
  each listed column exists, and the existing tests now assert sealed storage.
  dbtest installs a test key for integration tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/scrobble/queue_test.go

@@ -13,6 +13,7 @@ import (
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/dbtest"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/secret"
 )
 
 func testPool(t *testing.T) (*pgxpool.Pool, *dbq.Queries) {
@@ -63,8 +64,13 @@ func seed(t *testing.T, opts seedOpts) setup {
 		t.Fatalf("user: %v", err)
 	}
 	if opts.lbToken != "" {
+		// Stored sealed, as the settings route stores it.
+		sealed, err := secret.Seal(secret.ListenBrainzToken.Purpose(), u.ID.String(), opts.lbToken)
+		if err != nil {
+			t.Fatalf("seal token: %v", err)
+		}
 		if err := q.SetListenBrainzToken(ctx, dbq.SetListenBrainzTokenParams{
-			ID: u.ID, ListenbrainzToken: &opts.lbToken,
+			ID: u.ID, ListenbrainzToken: &sealed,
 		}); err != nil {
 			t.Fatalf("token: %v", err)
 		}

internal/scrobble/worker.go

@@ -11,6 +11,7 @@ import (
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/scrobble/listenbrainz"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/secret"
 )
 
 // backoffSchedule maps the failure count (1-indexed) to the delay before
@@ -98,7 +99,11 @@ func (w *Worker) tickOnce(ctx context.Context) error {
 		key := r.UserID.String()
 		ub := batches[key]
 		if ub == nil {
-			ub = &userBatch{token: *r.LbToken, userID: r.UserID}
+			token := secret.Reveal(secret.ListenBrainzToken.Purpose(), key, *r.LbToken)
+			if token == "" {
+				continue
+			}
+			ub = &userBatch{token: token, userID: r.UserID}
 			batches[key] = ub
 		}
 		ub.queueIDs = append(ub.queueIDs, r.QueueID)