feat: stored credentials are sealed at rest, so a copy of the database alone reveals none of them (#6767)

Minstrel keeps credentials it has to read back: indexer, Prowlarr and
download-client keys and passwords, the AcoustID key, cover-art and tag
provider keys, the SMTP password, and each user's ListenBrainz token and
Subsonic password. They were stored in the clear; they are now sealed with
AES-256-GCM under a per-column HKDF key derived from the stream secret, each
value bound to its row.

- internal/secret: Seal/Open/Reveal, and Columns, the one list of sealed
  columns (a backup will leave them out). Install takes the master key at
  startup; SealStored seals any value still in the clear, so an existing
  database is brought over in place on the first boot.
- Every write seals and every read opens: acquire (one read path, getService
  / usableServices), acoustid settings, SMTP, ListenBrainz, Subsonic auth and
  password generation, cover-art and tag provider settings.
- A value that does not open (the stream secret changed) is logged and reads
  as unset, to be entered again in Settings. docs/security.md says so.
- Tests: secret unit tests (wrong owner/purpose/key, malformed, no key), a
  SealStored integration test over all eight columns plus a schema check that
  each listed column exists, and the existing tests now assert sealed storage.
  dbtest installs a test key for integration tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/subsonic/auth.go

@@ -17,6 +17,7 @@ import (
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/secret"
 )
 
 // Config controls wire-format concessions the server makes for Subsonic
@@ -101,11 +102,15 @@ func authenticate(r *http.Request, pool *pgxpool.Pool, cfg Config) (dbq.User, in
 		return dbq.User{}, ErrGeneric, "Auth lookup failed"
 	}
 
+	// The stored Subsonic password is sealed; both t+s and p= compare against
+	// it opened. One that does not open reads as not configured.
+	subsonicPassword := secret.RevealPtr(secret.SubsonicPassword.Purpose(), user.ID.String(), user.SubsonicPassword)
+
 	if token, salt := params.Get("t"), params.Get("s"); token != "" && salt != "" {
-		if user.SubsonicPassword == nil {
+		if subsonicPassword == nil {
 			return dbq.User{}, ErrTokenNotSupported, "Subsonic token auth not configured; use apiKey or set a Subsonic password"
 		}
-		sum := md5.Sum([]byte(*user.SubsonicPassword + salt))
+		sum := md5.Sum([]byte(*subsonicPassword + salt))
 		expected := hex.EncodeToString(sum[:])
 		if subtle.ConstantTimeCompare([]byte(expected), []byte(token)) != 1 {
 			return dbq.User{}, ErrWrongCredentials, "Wrong username or password"
@@ -117,14 +122,14 @@ func authenticate(r *http.Request, pool *pgxpool.Pool, cfg Config) (dbq.User, in
 		if !cfg.AllowPlaintextPassword {
 			return dbq.User{}, ErrTokenNotSupported, "Plaintext password auth is disabled; use apiKey or t+s"
 		}
-		if user.SubsonicPassword == nil {
+		if subsonicPassword == nil {
 			return dbq.User{}, ErrTokenNotSupported, "Subsonic password not configured for this user"
 		}
 		decoded, err := decodePassword(password)
 		if err != nil {
 			return dbq.User{}, ErrWrongCredentials, "Malformed password"
 		}
-		if subtle.ConstantTimeCompare([]byte(*user.SubsonicPassword), []byte(decoded)) != 1 {
+		if subtle.ConstantTimeCompare([]byte(*subsonicPassword), []byte(decoded)) != 1 {
 			return dbq.User{}, ErrWrongCredentials, "Wrong username or password"
 		}
 		return user, 0, ""