Encrypt connection credentials with an owner-bound AES-GCM envelope

Adds a v2 credential envelope next to the v1 tool-secret helpers:
AES-256-GCM, a master key derived once per process from
ENCRYPTION_SECRET_KEY, and a per-record key from HKDF over the owner's
id, which is also the associated data, so a blob moved onto another
user's row does not decrypt. The envelope names its key, so
ENCRYPTION_SECRET_KEY_PREVIOUS keeps old rows readable during a
rotation.

Log redaction now also covers token_info, tokens and client_info, and
the API warns at startup when the public default key is in use.

docs/content/Deploying/Settings-Reference.mdx

@@ -34,7 +34,13 @@ Signing key for session tokens and other signed capabilities. Required on every
 
 Type `str`, default `default-docsgpt-encryption-key`.
 
-Key used to encrypt stored credentials such as tool and connector secrets.
+Key used to encrypt stored credentials such as tool and connector secrets. Set your own value before connecting services on a multi-user install; the default is public.
+
+### `ENCRYPTION_SECRET_KEY_PREVIOUS`
+
+Type `str`, default unset.
+
+Previous ENCRYPTION_SECRET_KEY, tried when a stored credential was encrypted with it. Set it while rotating the key, run `docsgpt connectors reencrypt`, then remove it.
 
 ### `INTERNAL_KEY`