security(integrations): encrypt credential payloads

[darwin67]

Summary

• encrypt versioned credential payloads with AES-256-GCM and a unique nonce per write
• bind ciphertext to integration, user, provider, authentication type, and payload format through AEAD associated data
• require a dedicated production key ring and block startup before readiness when configured or referenced keys are missing
• filter provider secrets and credential-derived identifiers from Phoenix and LiveView parameter logs
• document key distribution and rotation and update the release smoke environment

Verification

• focused integration security suite: 20 passed
• production-mode runtime key-ring configuration check passed
• mix precommit: 343 passed, 5 live-provider tests excluded

Stack

Depends on #28.