Connector credentials are now envelope-encrypted

Commerce connector credentials (Shopify, Amazon SP-API, and friends) are encrypted at rest with AES-256-GCM envelope encryption before they touch the database. Plaintext fallback has been removed.

If you connect a storefront or marketplace account, the OAuth tokens and API keys you hand us never sit unencrypted on disk. Reads now return a `__unreadable` sentinel instead of raw ciphertext when decryption fails, so a misconfigured key cannot leak a token through an error path.

AES-256-GCM envelope encryption applied to stored connector credentials

Plaintext fallback dropped: legacy rows are read once, re-encrypted, and the plain form is purged

Decrypt failures return a sentinel value, never the raw stored bytes

Same cryptographic wrapper used for workspace API keys is reused here so there is one path to audit

Questions or concerns: `support@last-price.ai`.