IP recovery sends encrypted miner credentials to plugins

[ankitgoswami]

🤖 Filed by an AI agent after reproducing this during manual IP scanner testing.

Problem

The IP recovery identity check reads miner credentials from miner_credentials, but forwards the encrypted database values to the plugin as if they were plaintext username and password values. Authenticated drivers therefore reject the identity probe, so Fleet cannot verify and repair the address of an offline miner even when the saved credentials are correct.

This is separate from #792, which covers Antminer discovery returning incomplete identity data.

Reproduction

1. Pair a Proto fake rig using valid credentials and verify it is PAIRED and ACTIVE.
2. Change its stored discovered IP to another address and mark it OFFLINE.
3. Restart Fleet so the IP scanner runs immediately.
4. Fleet discovers the rig at its real address, but IsSameDevice logs authentication failed for paired device, changes the target to AUTHENTICATION_NEEDED, and completes with devices_found=0.
5. Temporarily replace the encrypted credential columns with their plaintext values and rerun the scan. The same rig is verified by serial and MAC, and the stored address is corrected successfully.

Root cause

SQLDeviceStore.GetMinerCredentials returns username_enc and password_enc directly in pairing.v1.Credentials. pairing.Service.IsSameDevice passes those values to Pairer.GetDeviceInfo, which builds a plugin secret bundle without decrypting them.

Relevant paths:

• server/internal/domain/stores/sqlstores/device.go
• server/internal/domain/pairing/service.go
• server/internal/domain/plugins/pairer.go

The affected code is unchanged by #782 and is present on main.

Impact

Automatic IP recovery fails for drivers that authenticate while describing a rediscovered device. Valid paired credentials can also be incorrectly reported as stale by moving the miner to AUTHENTICATION_NEEDED.

Expected behavior

Identity verification should provide decrypted credentials to the plugin while encrypted values remain confined to the persistence boundary. A failed probe against a different discovered miner should not invalidate the target credentials.

Acceptance criteria

• Stored credentials are decrypted before the IP recovery identity probe reaches the plugin.
• A Proto fake rig with a deliberately stale stored IP is rediscovered and updated using normally encrypted stored credentials.
• Authentication failures during subnet probing do not incorrectly invalidate valid credentials for the target device.
• Regression coverage verifies the encrypted-storage-to-plaintext-plugin boundary.