Encrypt connection credentials with an owner-bound AES-GCM envelope

Adds a v2 credential envelope next to the v1 tool-secret helpers:
AES-256-GCM, a master key derived once per process from
ENCRYPTION_SECRET_KEY, and a per-record key from HKDF over the owner's
id, which is also the associated data, so a blob moved onto another
user's row does not decrypt. The envelope names its key, so
ENCRYPTION_SECRET_KEY_PREVIOUS keeps old rows readable during a
rotation.

Log redaction now also covers token_info, tokens and client_info, and
the API warns at startup when the public default key is in use.

docsgpt/core/settings/auth.py

@@ -29,7 +29,17 @@ class AuthSettings(SettingsGroup):
     )
     ENCRYPTION_SECRET_KEY: str = Field(
         default="default-docsgpt-encryption-key",
-        description="Key used to encrypt stored credentials such as tool and connector secrets.",
+        description=(
+            "Key used to encrypt stored credentials such as tool and connector secrets. Set your own value before "
+            "connecting services on a multi-user install; the default is public."
+        ),
+    )
+    ENCRYPTION_SECRET_KEY_PREVIOUS: Optional[str] = Field(
+        default=None,
+        description=(
+            "Previous ENCRYPTION_SECRET_KEY, tried when a stored credential was encrypted with it. Set it while "
+            "rotating the key, run `docsgpt connectors reencrypt`, then remove it."
+        ),
     )
     INTERNAL_KEY: Optional[str] = Field(
         default=None, description="Internal API key for worker-to-backend authentication."