QuickandClaude Opus 4.8
ed8f63c886
Plan for issue #45: a reusable internal/secret AES-256-GCM package keyed by a required SECRET_KEY (HKDF), inline-encrypted api_key_ref columns that replace the SecretResolver indirection, an EncryptedSettings decorator for sensitive server_settings, and an idempotent startup backfill with resolve-then-encrypt for legacy arr references. Plan doc only; no code changes. Refs #45 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>