feat(backend): encrypt stored GitHub access tokens

[marcalexiei]

• Closes Access tokens stored in plaintext in Postgres #397

---

• authenticated_users.access_token is AES-256-GCM encrypted when TOKEN_ENCRYPTION_KEY is set (AccessTokenCipher), with user_id as AAD;
  without a key it stays plaintext and a warning is logged on boot.
• Reads accept legacy plaintext. An unreadable token comes back as token: null:
  /api/user-access and /api/downgrade drop the row so the user logs in again, cards fall back to the public PAT.
  A bad key fails on the token paths only, not on import.
• TOKEN_ENCRYPTION_KEY=<new>,<old> rotates: first key encrypts, all decrypt.
• pnpm --filter ./apps/backend run encrypt-access-tokens re-encrypts the rows not yet on the first key, with compare-and-swap, and exits non-zero on unreadable ones or a missing key.

[vercel]

@marcalexiei is attempting to deploy a commit to the martin-mfg's projects Team on Vercel.

A member of the Team first needs to authorize it.