feat: stored credentials are sealed at rest, so a copy of the database alone reveals none of them (#6767)

Minstrel keeps credentials it has to read back: indexer, Prowlarr and
download-client keys and passwords, the AcoustID key, cover-art and tag
provider keys, the SMTP password, and each user's ListenBrainz token and
Subsonic password. They were stored in the clear; they are now sealed with
AES-256-GCM under a per-column HKDF key derived from the stream secret, each
value bound to its row.

- internal/secret: Seal/Open/Reveal, and Columns, the one list of sealed
  columns (a backup will leave them out). Install takes the master key at
  startup; SealStored seals any value still in the clear, so an existing
  database is brought over in place on the first boot.
- Every write seals and every read opens: acquire (one read path, getService
  / usableServices), acoustid settings, SMTP, ListenBrainz, Subsonic auth and
  password generation, cover-art and tag provider settings.
- A value that does not open (the stream secret changed) is logged and reads
  as unset, to be entered again in Settings. docs/security.md says so.
- Tests: secret unit tests (wrong owner/purpose/key, malformed, no key), a
  SealStored integration test over all eight columns plus a schema check that
  each listed column exists, and the existing tests now assert sealed storage.
  dbtest installs a test key for integration tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/secret/stored.go

@@ -0,0 +1,112 @@
+package secret
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// Column is one database column that holds a sealed credential.
+//
+// Its Purpose ("table.column") is the key-derivation label every Seal and
+// Open of that column passes. The owner a value is bound to is the row's key
+// as text (KeyColumn::text), or "" for a single-row settings table.
+type Column struct {
+	Table     string
+	Column    string
+	KeyColumn string
+	Singleton bool
+}
+
+// Purpose is the label Seal and Open take for this column.
+func (c Column) Purpose() string { return c.Table + "." + c.Column }
+
+// The sealed columns, and the purpose strings their callers pass. Every
+// credential Minstrel stores for an outside system, or that must be read back
+// in the clear, is listed here.
+var (
+	AcquisitionAPIKey   = Column{"acquisition_services", "api_key", "code", false}
+	AcquisitionPassword = Column{"acquisition_services", "password", "code", false}
+	AcoustIDAPIKey      = Column{"acoustid_settings", "api_key", "id", true}
+	SMTPPassword        = Column{"smtp_config", "password", "id", true}
+	ListenBrainzToken   = Column{"users", "listenbrainz_token", "id", false}
+	SubsonicPassword    = Column{"users", "subsonic_password", "id", false}
+	CoverArtAPIKey      = Column{"cover_art_provider_settings", "api_key", "provider_id", false}
+	TagProviderAPIKey   = Column{"tag_provider_settings", "api_key", "provider_id", false}
+)
+
+// Columns is every sealed column, for SealStored and for anything that has to
+// know which columns hold credentials (a backup leaves them out).
+var Columns = []Column{
+	AcquisitionAPIKey, AcquisitionPassword, AcoustIDAPIKey, SMTPPassword,
+	ListenBrainzToken, SubsonicPassword, CoverArtAPIKey, TagProviderAPIKey,
+}
+
+// Owner is the owner string for a row whose key is key. A single-row table's
+// rows are owned by "".
+func (c Column) Owner(key string) string {
+	if c.Singleton {
+		return ""
+	}
+	return key
+}
+
+// SealStored seals every value in Columns that is still stored in the clear,
+// and returns how many it sealed. The server runs it at startup, after
+// migrations and before anything reads a credential, so a database written
+// before sealing existed is brought over in place. Each row is updated only
+// if it still holds the value that was read, so a concurrent write wins.
+func SealStored(ctx context.Context, pool *pgxpool.Pool) (int, error) {
+	total := 0
+	for _, c := range Columns {
+		n, err := sealColumn(ctx, pool, c)
+		total += n
+		if err != nil {
+			return total, fmt.Errorf("seal %s: %w", c.Purpose(), err)
+		}
+	}
+	return total, nil
+}
+
+func sealColumn(ctx context.Context, pool *pgxpool.Pool, c Column) (int, error) {
+	table := pgx.Identifier{c.Table}.Sanitize()
+	col := pgx.Identifier{c.Column}.Sanitize()
+	key := pgx.Identifier{c.KeyColumn}.Sanitize()
+
+	rows, err := pool.Query(ctx, fmt.Sprintf(
+		`SELECT %s::text, %s FROM %s WHERE %s IS NOT NULL AND %s <> '' AND %s NOT LIKE 'v1.%%'`,
+		key, col, table, col, col, col))
+	if err != nil {
+		return 0, err
+	}
+	type pending struct{ key, plain string }
+	var todo []pending
+	for rows.Next() {
+		var p pending
+		if err := rows.Scan(&p.key, &p.plain); err != nil {
+			rows.Close()
+			return 0, err
+		}
+		todo = append(todo, p)
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return 0, err
+	}
+
+	update := fmt.Sprintf(`UPDATE %s SET %s = $1 WHERE %s::text = $2 AND %s = $3`, table, col, key, col)
+	sealed := 0
+	for _, p := range todo {
+		v, err := Seal(c.Purpose(), c.Owner(p.key), p.plain)
+		if err != nil {
+			return sealed, err
+		}
+		if _, err := pool.Exec(ctx, update, v, p.key, p.plain); err != nil {
+			return sealed, err
+		}
+		sealed++
+	}
+	return sealed, nil
+}