feat(core): Encrypt secret custom fields and config args at rest - #5051

…s at rest

A custom field or config arg marked `secret: true` has its value encrypted via
the configured EncryptionStrategy before being stored, and decrypted when
loaded. Custom-field secrets use a TypeORM value transformer and are stored as
unbounded text; config-arg secrets are encrypted in ConfigArgService.parseInput
and decrypted in argsArrayToHash. When the API returns a redaction placeholder
for a secret, submitting that placeholder back on an update preserves the
stored value; on a create it is rejected.

Relates to #2648

…values

The decrypted value of a `secret` custom field or config arg is only returned
to callers permitted by the SecretAccessStrategy (by default, holders of
Permission.ReadSecret); everyone else receives a redaction placeholder. This
adds field resolvers for PaymentMethod and ShippingMethod handler/checker
operations, which previously returned the raw stored value, and applies the
same rule to custom field resolvers. Secret custom fields are also excluded
from the generated filter and sort inputs, since their stored value is
ciphertext.

Relates to #2648

Verify that secret values are stored encrypted, are returned decrypted only to
ReadSecret holders and redacted otherwise, are preserved when the placeholder
is submitted on update, and are rejected when the placeholder is submitted on
create. Also updates the administrator snapshot for the new ReadSecret
permission.

Relates to #2648

Relates to #2648

Relates to #2648

Secret config arg handling was wired per-resolver and only covered PaymentMethod
and ShippingMethod, so a secret arg on a collection filter or promotion
condition/action returned raw ciphertext to any reader and double-encrypted on
edit.

Move redaction to a single ConfigurableOperation.args field resolver that gates
every configurable operation in the API, keyed on the self-identifying ciphertext
prefix, so any operation type (core or custom) is covered with no per-resolver
wiring. Thread previously-stored values into the promotion and collection update
paths so a resubmitted placeholder is preserved. Replace SecretAccessInput with a
discriminated union on kind (customField | configArg) and validate that secret
config args are non-list strings at bootstrap.

Relates to #2648

Store a known value encrypted with the active key the first time an encryption
key is used against a database, and verify it on every startup. If the configured
key no longer matches (e.g. a database was restored into an environment with a
different VENDURE_ENCRYPTION_KEY, or the key was changed), the server fails to
start with a clear error instead of failing later with scattered runtime
decryption errors. The check uses the settings store, so no schema change is
required, and is purely additive: if the store cannot be read it is skipped.

Relates to #2648

The DefaultEncryptionStrategy no longer reads VENDURE_ENCRYPTION_KEY from the
environment directly. Following Vendure's convention that environment variables
are read in the config and passed into strategies, the secret must be provided
explicitly via the strategy's `secret` option. When a secret field or arg is
configured without a usable key, the bootstrap error now shows the exact config
to add.

Relates to #2648

The bootstrap key-check value was registered in the settings store without a read
permission, so any authenticated user could fetch it via getSettingsStoreValue.
Because it is a known plaintext encrypted with the active key, that gave an offline
brute-force oracle for the encryption secret. Restrict read access to the SuperAdmin,
who already has full access to decrypted secrets.

Relates to #2648

The systemic resolver redacted a config arg only when its stored value looked
encrypted. A secret arg holding a plaintext value — e.g. data written before the
field was marked secret, or via a raw insert — was served in the clear to any
caller with the ordinary read permission, bypassing ReadSecret. Redact based on
the arg's `secret` definition instead, so such values are redacted (and only
decrypted, or returned as-is when legacy plaintext, for a ReadSecret holder).

Relates to #2648

Key derivation used a single unsalted SHA-256 of the secret, which is cheap to
brute-force offline for a weak or low-entropy secret. Switch to scrypt, a
memory-hard KDF, so each guess is expensive, and warn at startup when the secret
is shorter than the recommended length. The salt is a fixed application constant,
since the key must be derived synchronously at bootstrap.

Relates to #2648

…fields

The custom-field secret resolver passed the customFields wrapper object instead
of the owning VendureEntity, breaking the documented SecretAccessInput contract
and preventing entity-aware authorization. Retain and pass the actual entity.

Relates to #2648

The secret field-type validation ran only in the non-relation branch, so a
relation custom field with secret:true was silently registered without encryption
or redaction. Validate the type and list constraints before branching so
unsupported types are rejected at registration.

Relates to #2648

Custom-field transformers and configurable-operation execution called decrypt()
unconditionally, including on legacy plaintext, although the strategy contract only
requires decrypt() to handle values produced by encrypt(). Check isEncrypted()
first and return plaintext unchanged otherwise, so custom strategies need not
tolerate non-ciphertext and enabling secret on existing data keeps working.

Relates to #2648

A secret custom field or config arg with no explicit ui.component now renders as a
masked (revealable) password input in the dashboard, and its read-only summary is
masked too, so it is visually clear the value is sensitive even for a user permitted
to read it. An explicit ui.component still takes precedence.

Relates to #2648

Extract the 'secret fields default to the masked password input' logic into a
single `resolveInputComponentId` helper used by both the form control and the
configurable-operation summary, replacing the duplicated `secret` casts now that
the field config types expose `secret` directly.

Also forward `onBlur` and `name` from PasswordFormInput, so secret fields routed
through it keep blur-driven validation and the input name attribute.

Relates to #2648

Registers the new "Hidden — you do not have permission to view this value" label
in the message catalogs. Non-source locales are left untranslated, to be filled
by the periodic bulk translation pass like other pending strings.

Relates to #2648