feat!: opt-in credential encryption via FieldDescriptor isEncrypted()

[rhoerr]

Summary

Makes credential encryption opt-in per field descriptor instead of guessing from field names — the last piece of the FieldDescriptor schema from the original architecture review, done now while it's still a cheap change (pre-1.0.0).

• FieldDescriptorInterface::isEncrypted(): bool (breaking interface addition); FieldFactoryTrait::apiKeyField() marks itself encrypted.
• SensitiveDataProcessor now receives the registered AiServiceConfigurationInterface[] (di.xml) and decides sensitivity from each service's field schema; public methods take the service code first (breaking signatures). For unknown service codes, or fields absent from a known schema, it falls back to the previous name heuristic (apikey/api_key/token/secret) — covering rows whose third-party provider module was removed, plus defense in depth. Schema is authoritative when it describes a field: an in-schema field named token left unmarked stays plaintext.
• Admin form schema JSON carries the flag; the form JS forces password inputs for encrypted fields regardless of declared type.

Third-party providers now opt fields into encryption explicitly ('encrypted' => true) regardless of naming.

PR chain: #2 → #3 → #4 → #5 → #6 → this. Retargets as bases merge; breaking changes ship unreleased.

Test plan

• 21 SensitiveDataProcessor tests incl. schema-marked field with non-matching name, in-schema unmarked field staying plaintext, both fallback paths, invalid registration.
• EncryptedServicesTest exercises the schema path end-to-end (4 tests, pass under full Magento autoload).
• vendor/bin/phpcs exits 0; suite at 49 tests with only the pre-existing generated-factory environment errors.

🤖 Generated with Claude Code