feat: encrypt sensitive values in app.yaml with AES-256-GCM

Passwords and secrets from deploy fields (type: password/secret) are now
encrypted at rest in app.yaml using a per-node 32-byte key. Values stored
as ENC:base64(nonce+ciphertext), decrypted transparently for docker-compose
and web UI. Key included in infra backup bundle for disaster recovery.
Existing plaintext values migrated automatically on startup.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/web/server.go

@@ -37,6 +37,7 @@ type Server struct {
 	updater          *selfupdate.Updater
 	logger           *log.Logger
 	version          string
+	encKey           []byte // AES-256 key for decrypting app.yaml values
 	tmpl             *template.Template
 
 	sessions   map[string]*session
@@ -107,6 +108,11 @@ func NewServer(cfg *config.Config, stackMgr *stacks.Manager, cpuCollector *syste
 	return s
 }
 
+// SetEncryptionKey sets the AES-256 key used to decrypt app.yaml values for display.
+func (s *Server) SetEncryptionKey(key []byte) {
+	s.encKey = key
+}
+
 func (s *Server) loadTemplates() {
 	s.tmpl = template.Must(
 		template.New("").Funcs(s.templateFuncMap()).ParseFS(templateFS, "templates/*.html"),