feat(enterprise): harden provider secret store

[Gracker]

Summary

• replace provider SecretStore payload encryption with libsodium secretbox and OS-keyring/env-backed master key resolution
• keep legacy AES secret files readable by migrating them to the new libsodium envelope on first read
• add provider secret create/write/read/delete/rotate audit events without storing plaintext or raw secret refs
• add provider secret rotation API and mark README §0.3.9 complete

Verification

• PATH="$HOME/.nvm/versions/node/v24.15.0/bin:$PATH" npm run typecheck (backend)
• PATH="$HOME/.nvm/versions/node/v24.15.0/bin:$PATH" npx jest --runInBand --forceExit src/services/providerManager/tests/localSecretStore.test.ts src/services/providerManager/tests/enterpriseProviderStore.test.ts (backend)
• PATH="$HOME/.nvm/versions/node/v24.15.0/bin:$PATH" npx jest --runInBand --forceExit src/services/providerManager/tests/providerRoutes.test.ts src/services/providerManager/tests/providerService.test.ts src/services/providerManager/tests/providerSnapshot.test.ts (backend)
• PATH="$HOME/.nvm/versions/node/v24.15.0/bin:$PATH" npm run test:core (backend)
• git diff --check
• PATH="$HOME/.nvm/versions/node/v24.15.0/bin:$PATH" npm run test:scene-trace-regression (backend)
• PATH="$HOME/.nvm/versions/node/v24.15.0/bin:$PATH" npm run verify:pr

[Gracker]

已通过 commit 67856ec (merge) + 023a84a (frontend rebuild) 合入 main，关闭此 PR。