fix: harden local workspace persistence

[erickkkyt]

Summary

• encrypt locally stored provider secrets with an automatic per-install SQLite key and migrate legacy plaintext rows
• prevent stale canvas snapshots from overwriting newer tab state
• reject active/conflicting upload MIME types and harden local asset responses
• keep arbitrary public provider media URLs compatible while blocking private literal hosts
• bound JSON requests and provider response bodies, add timeouts, and remove full media URL logs

Verification

• pnpm typecheck
• pnpm test (212 passed)
• pnpm i18n:check
• pnpm build
• pnpm cf:build
• pnpm audit --prod --audit-level high
• Codex Security diff scan: 0 reportable findings
• staged, tracked-tree, and Git-history secret-pattern scans: clean

Scope

• no database schema changes
• no external API shape changes
• untracked public/demo-assets intentionally excluded