feat: encrypt stored service credentials

tests/security/test_credentials.py

@@ -0,0 +1,20 @@
+from cryptography.fernet import Fernet
+
+from app.security.credentials import CredentialCipher
+
+
+def test_round_trip_and_ciphertext_does_not_contain_plaintext() -> None:
+    cipher = CredentialCipher(Fernet.generate_key().decode("ascii"))
+    encrypted = cipher.encrypt("secret-password")
+
+    assert "secret-password" not in encrypted
+    assert cipher.decrypt(encrypted) == "secret-password"
+
+
+def test_empty_credentials_are_rejected() -> None:
+    cipher = CredentialCipher(Fernet.generate_key().decode("ascii"))
+    try:
+        cipher.encrypt("")
+    except ValueError:
+        return
+    raise AssertionError("empty secrets must be rejected")