Add owner-only encrypted user secret store

[kirillmitrofanov]

Summary

• Owner-only encrypted secret vault in existing Postgres (AES-GCM envelope). Flow JSON, export, codegen, MCP, and GET /code/ store SecretRef names only.
• Jupyter injects in-process; Slurm writes mode-0600 .nw-secrets then shreds; LocalExecutor uses NW_SECRET_* env. Missing secrets fail closed. Non-owners cannot decrypt or inject.

Test plan

• poetry run pytest django-project/tests/test_secret_crypto.py django-project/tests/test_user_secret_model.py django-project/tests/test_secrets_api.py django-project/tests/test_secret_inject.py django-project/tests/test_aspera_secret.py django-project/tests/test_customdb_vault.py
• PYTHONPATH=src pytest tests/test_core_secrets.py
• npx vitest run src/utils/secretRefs.test.ts (frontend)
• Create ASPERA_PASSWORD in Settings → Secrets, bind on AsperaSharesLoaderNode password, confirm UI shows •••• + name
• Export Flow JSON / GET /code/ contain SecretRef("ASPERA_PASSWORD") only
• Do not deploy without setting SECRETS_MASTER_KEY

Ops note

Set SECRETS_MASTER_KEY before deploying (python3 -c "import secrets; print(secrets.token_urlsafe(32))"). Production (DEBUG=false) must not boot if the master key is missing. SECRETS_MASTER_KEY_PREVIOUS is for rotation. Do not put a real key in git. This PR does not deploy to dbrain.jp / /data/neuro-workflow.