secrets: encrypted device-local key store (basic) + OPFS provider settings

[mkotelnikov]

M1a code work. Implements sandclaw-ai/internal.sandclaw.ai#6. Encrypted device-local secret store for API keys (keys never in JSON config); provider settings stored in OPFS above the workspace so onboarding works without dir access.
Epic:

[mkotelnikov]

Part of M1a epic: https://github.com/sandclaw-ai/internal.sandclaw.ai/issues/24