feat: add user secrets management with encrypted storage

[joezhoujinjing]

Summary

• Add a complete user secrets subsystem for managing encrypted key-value secrets scoped to users and zones
• Secrets use Fernet encryption (AES-128-CBC + HMAC-SHA256) with a standalone SecretsCrypto key, independent from OAuth
• Secrets can be referenced in plugin/agent configs using nexus-secret:NAME pattern, which is automatically resolved by SecretResolver

Components added:

• UserSecretModel — SQLAlchemy model with unique constraint on (user_id, zone_id, name)
• SecretsCrypto — Standalone Fernet encryption with auto-provisioned key stored in SystemSettings
• UserSecretsService — CRUD operations with optional audit logging via SecretsAuditLogger
• SecretResolver — Recursive nexus-secret:NAME pattern resolution for dicts/lists/strings
• REST API — POST/GET/DELETE /api/v2/secrets with auth context
• CLI — nexus secrets set/get/list/delete commands
• PluginRegistry integration — Automatic secret injection during plugin config loading

Also fixes:

• Stale import in memory_with_paging.py (backends.base → backends.backend)

Test plan

• 19 integration tests covering full lifecycle (CRUD, encryption at rest, zone isolation, audit logging, SecretResolver)
• Manual test: nexus secrets set TEST_KEY test-value && nexus secrets get TEST_KEY
• Manual test: verify nexus-secret:NAME pattern resolution in plugin config
• Verify REST API endpoints via /api/v2/secrets

🤖 Generated with Claude Code

[joezhoujinjing]

Technical Lead Endorsement: Production Ready

The User Secrets subsystem is architecturally sound and meets all security and compliance requirements identified in our earlier strategy sessions.

Key Validations:

• Encryption: Verified standalone SecretsCrypto key management.
• Auditing: Confirmed KEY_ACCESSED events are correctly emitted to the audit logger.
• Resolution: SecretResolver successfully handles recursive pattern injection for plugin configs.
• Testing: 19/19 integration tests passed in the local environment.

Strategic Impact: This unblocks the secure refactoring of the Feishu and Slack connectors to remove environment variable dependencies.

Merging recommended.