feat(crypto): add master key loader and Fernet encrypt/decrypt helpers

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/service/secret_store.py

@@ -135,6 +135,12 @@ def read_secret(storage: str, secret_ref: str) -> str:
         )
         return val
 
+    elif storage_n == "local_encrypted":
+        raise ValueError(
+            "local_encrypted backend cannot be read via secret_ref. "
+            "Use credentials_repo.read_credential_plaintext() instead."
+        )
+
     else:
         log.error("secret_resolve_failed unsupported storage=%s", storage)
         raise ValueError(f"Unsupported secret storage type: {storage}")
@@ -304,3 +310,14 @@ def _win_cred_delete_impl(target: str) -> None:
         err = ctypes.get_last_error()
         if err != 1168:
             raise OSError(f"CredDeleteW failed with error {err}")
+
+
+def encrypt_secret_for_storage(secret_value: str) -> str:
+    """加密 secret 用于 secret_storage='local_encrypted'。
+
+    返回密文字符串，调用方负责写到 credentials.secret_ciphertext 列。
+    """
+    from service.crypto import encrypt_secret
+
+    return encrypt_secret(secret_value)
+