fix(security): protect stored credentials and make API secret fields write-only (#101)

[BerryUIKI]

Summary

Resolves #101 (F01).

• Encrypted Local Storage: Uses Windows DPAPI (CryptProtectData / CryptUnprotectData via ctypes) to encrypt credentials stored in credentials.json so raw secrets are never persisted in plaintext. Retains backward compatibility with legacy unencrypted credential files.
• Surface Persistence Errors: CredentialManager persistence failures raise an actionable OSError and endpoints return HTTP 500 rather than silently claiming success.
• Secret Redaction: GET /api/v1/agent/llm/config and credential save endpoints return redacted keys (never full secrets).
• Write-Only Semantics: Updating configuration with a redacted or omitted key preserves the stored key rather than overwriting it.
• Regression Tests: Added backend/tests/test_credentials_security.py covering encryption, redaction, and write-failure propagation.

Verification

• pytest backend/tests/test_credentials_security.py: 7/7 passed.
• Full backend pytest: 164/164 passed.