Add encryption and setup wizard features

ENCRYPTION:
- Add cryptography library for secure storage
- Implement Fernet encryption for sensitive settings
- Key derived from SESSION_SECRET
- Auto-encrypt/decrypt transparent to app
- "enc:" prefix identifies encrypted values
- Graceful fallback if crypto unavailable

SETUP WIZARD:
- Detect fresh installs needing configuration
- 3-step wizard: Infrastructure, Security, AI Services
- "/" redirects to wizard if setup required
- Auto-generate session_secret option
- Skip option for advanced users
- Beautiful UI with progress indicators

UI IMPROVEMENTS:
- Enhanced sensitive field display
- Lock icon showing encryption status
- Improved show/hide toggle for passwords
- Better visual hierarchy

FILES:
- app/utils/encryption.py - Encryption utilities
- app/utils/setup_wizard.py - Wizard detection logic
- app/views/wizard.py - Wizard routes
- frontend/templates/setup_wizard.html - Wizard UI
- requirements.txt - Added cryptography
- IMPLEMENTATION_CHECKLIST.md - Status tracking

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/utils/settings_service.py

@@ -878,16 +878,27 @@ def get_setting_from_db(db: Session, key: str) -> Optional[str]:
     """
     Retrieve a setting value from the database.
     
+    Automatically decrypts sensitive values if encryption is enabled.
+    
     Args:
         db: Database session
         key: Setting key to retrieve
         
     Returns:
-        Setting value as string, or None if not found
+        Setting value as string (decrypted if necessary), or None if not found
     """
     try:
         setting = db.query(ApplicationSettings).filter(ApplicationSettings.key == key).first()
-        return setting.value if setting else None
+        if not setting:
+            return None
+        
+        # Check if this setting is sensitive and should be decrypted
+        metadata = get_setting_metadata(key)
+        if metadata.get("sensitive", False):
+            from app.utils.encryption import decrypt_value
+            return decrypt_value(setting.value)
+        
+        return setting.value
     except SQLAlchemyError as e:
         logger.error(f"Error retrieving setting {key} from database: {e}")
         return None
@@ -897,6 +908,8 @@ def save_setting_to_db(db: Session, key: str, value: Optional[str]) -> bool:
     """
     Save or update a setting in the database.
     
+    Automatically encrypts sensitive values if encryption is enabled.
+    
     Args:
         db: Database session
         key: Setting key
@@ -906,11 +919,24 @@ def save_setting_to_db(db: Session, key: str, value: Optional[str]) -> bool:
         True if successful, False otherwise
     """
     try:
+        # Check if this setting is sensitive and should be encrypted
+        metadata = get_setting_metadata(key)
+        storage_value = value
+        
+        if metadata.get("sensitive", False) and value:
+            from app.utils.encryption import encrypt_value, is_encryption_available
+            
+            if is_encryption_available():
+                storage_value = encrypt_value(value)
+                logger.debug(f"Encrypted sensitive setting: {key}")
+            else:
+                logger.warning(f"Storing sensitive setting {key} in plaintext (encryption unavailable)")
+        
         setting = db.query(ApplicationSettings).filter(ApplicationSettings.key == key).first()
         if setting:
-            setting.value = value
+            setting.value = storage_value
         else:
-            setting = ApplicationSettings(key=key, value=value)
+            setting = ApplicationSettings(key=key, value=storage_value)
             db.add(setting)
         db.commit()
         logger.info(f"Saved setting {key} to database")
@@ -925,15 +951,28 @@ def get_all_settings_from_db(db: Session) -> Dict[str, str]:
     """
     Retrieve all settings from the database.
     
+    Automatically decrypts sensitive values if encryption is enabled.
+    
     Args:
         db: Database session
         
     Returns:
-        Dictionary of setting key-value pairs
+        Dictionary of setting key-value pairs (decrypted)
     """
     try:
         settings = db.query(ApplicationSettings).all()
-        return {setting.key: setting.value for setting in settings}
+        result = {}
+        
+        for setting in settings:
+            # Check if this setting is sensitive and should be decrypted
+            metadata = get_setting_metadata(setting.key)
+            if metadata.get("sensitive", False):
+                from app.utils.encryption import decrypt_value
+                result[setting.key] = decrypt_value(setting.value)
+            else:
+                result[setting.key] = setting.value
+        
+        return result
     except SQLAlchemyError as e:
         logger.error(f"Error retrieving all settings from database: {e}")
         return {}