Encrypt Nextcloud passwords at rest, never return them via API

Passwords are encrypted with AES-256-GCM before being written to
users.json. The GET /api/users/:token endpoint no longer returns the
password field, so the settings form asks users to re-enter only when
changing it. Legacy plaintext passwords in users.json are decrypted
transparently and re-encrypted on next save.

Requires a new ENCRYPTION_KEY env var (64-char hex, 32 bytes).

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

public/index.html

@@ -312,9 +312,12 @@
 
         document.getElementById('nextcloudUrl').value = user.nextcloudUrl
         document.getElementById('username').value = user.username
-        document.getElementById('password').value = user.password
         document.getElementById('folder').value = user.folder
 
+        const pwField = document.getElementById('password')
+        pwField.placeholder = 'Leave blank to keep your current password'
+        pwField.required = false
+
         document.getElementById('adminSection').classList.add('hidden')
         document.getElementById('submitBtn').textContent = 'Update settings'
         document.getElementById('subtitle').textContent = 'Update your integration settings'