feat: Add encrypted Groq BYOK credential storage and resolution

[NirmalSingh-09]

Closes #368
What this PR does
Implements encrypted Groq BYOK (Bring Your Own Key) credential storage so user API keys are never persisted in plaintext.
Changes

src/prisma/schema.prisma — adds ProviderCredential model with ciphertext, keyVersion, maskedSuffix, revocation state
src/lib/crypto.ts — AES-256-GCM envelope encryption (random data key per credential, encrypted with master key)
src/lib/env.ts — adds CREDENTIAL_MASTER_KEY validation
src/modules/credentials/ — service, controller, types, index
src/app/api/credentials/ — POST /api/credentials, GET /api/credentials, DELETE /api/credentials/:id
src/lib/crypto.test.ts — 6 passing tests verifying encrypt/decrypt, no plaintext leakage, random IVs

Security guarantees

Plaintext keys are never persisted — only ciphertext stored in DB
API responses expose only masked suffix (last 4 chars)
resolveForInternalUse is server-side only — never called from client or queues
Migration note: requires CREDENTIAL_MASTER_KEY (min 32 chars) in .env

[vercel]

@NirmalSingh-09 is attempting to deploy a commit to the Adarsh's projects Team on Vercel.

A member of the Team first needs to authorize it.

[MRIARC-08]

@NirmalSingh-09 I can’t review or merge this one yet because it now conflicts with current main in src/prisma/schema.prisma.

Main has picked up new Prisma schema changes from recently merged PRs, so please rebase this branch on the latest main, resolve the schema conflict, regenerate Prisma/lockfile output only if needed, and push the result.

After that I’ll recheck the credential encryption and response-sanitization behavior.

[NirmalSingh-09]

@MRIARC-08 Rebased onto latest upstream main and resolved the schema.prisma conflict.