Fix per-user settings secret encryption

[JoesnageL]

Summary

• derive settings secret encryption keys from the master SETTINGS_ENCRYPTION_KEY plus user_id
• return per-user crypto keys from /api/settings/crypto-key instead of the shared master key
• keep legacy master-key encrypted blobs readable and migrate them to per-user encryption on settings GET
• update daemon secret loading/writing to use per-user derived keys with legacy fallback

Tests

• pnpm exec vitest run apps/web/src/lib/server-crypto.test.ts apps/daemon/src/user-config.test.ts (22 passed)

Fixes #14