3.14 Password Vault encryption AES-256-GCM server-side

- Created src/core/crypto/ with AES-256-GCM encrypt/decrypt (PBKDF2 key derivation)
- Created /api/vault route: CRUD with server-side password encryption
- PATCH /api/vault migration endpoint to re-encrypt legacy plaintext passwords
- Rewrote use-vault hook to use dedicated /api/vault instead of generic storage
- Updated UI: amber 'not encrypted' warning  green 'encrypted' badge
- Added ENCRYPTION_SECRET env var to docker-compose.yml and stack.env
- Module version bumped to 0.2.0

src/modules/password-vault/config.ts

@@ -1,17 +1,18 @@
-import type { ModuleConfig } from '@/core/module-registry/types';
+import type { ModuleConfig } from "@/core/module-registry/types";
 
 export const passwordVaultConfig: ModuleConfig = {
-  id: 'password-vault',
-  name: 'Seif Parole',
-  description: 'Manager securizat de parole și credențiale cu criptare locală',
-  icon: 'lock',
-  route: '/password-vault',
-  category: 'operations',
-  featureFlag: 'module.password-vault',
-  visibility: 'admin',
-  version: '0.1.0',
+  id: "password-vault",
+  name: "Seif Parole",
+  description:
+    "Manager securizat de parole și credențiale cu criptare AES-256-GCM",
+  icon: "lock",
+  route: "/password-vault",
+  category: "operations",
+  featureFlag: "module.password-vault",
+  visibility: "admin",
+  version: "0.2.0",
   dependencies: [],
-  storageNamespace: 'password-vault',
+  storageNamespace: "password-vault",
   navOrder: 11,
-  tags: ['parole', 'securitate', 'credențiale'],
+  tags: ["parole", "securitate", "credențiale", "criptare"],
 };