Add encryption for credential storage

[shtse8]

Summary

Credentials are currently stored in plaintext JSON files. This is a security risk for production use.

Current State

• Credentials stored in ~/.sylphx-code/credentials.json (global)
• Credentials stored in .sylphx-code/credentials.local.json (project)
• Files use restrictive permissions (0600) but content is plaintext

Proposed Solution

Add encryption layer for credential storage:

• Use AES-256-GCM for encryption
• Derive encryption key from system keyring or user password
• Encrypt only the apiKey field, keep metadata readable
• Maintain backward compatibility with plaintext for migration

Affected Files

• packages/code-core/src/registry/credential-registry.ts
• packages/code-core/src/config/credential-manager.ts
• packages/code-core/src/types/credential.types.ts

Priority

Medium - Current implementation is acceptable for development/single-user use, but required before production release.

References

• OWASP: Cryptographic Storage Cheat Sheet