Security: Encrypt PAT tokens at rest

[BrawlerXull]

Issue

GitHub PAT credentials are stored as plaintext in MongoDB, despite encryption infrastructure being available for other credential types.

Changes Made

• Add Agent.PATSealed field (AES-256-GCM encrypted)
• Add GetPAT() / SetPAT() methods with backward compatibility
• Update all PAT access points to use encryption
• Update build, promote, SAST executors
• Fix Dockerfile: Go 1.24 → 1.25

Security Impact

Encrypts PAT tokens at rest, matching pattern for AWS/GCP/KV credentials.

Testing

✅ Encryption/decryption tested
✅ Backward compatibility verified
✅ Docker build passes
✅ Code compiles