Add encryption and setup wizard features

ENCRYPTION:
- Add cryptography library for secure storage
- Implement Fernet encryption for sensitive settings
- Key derived from SESSION_SECRET
- Auto-encrypt/decrypt transparent to app
- "enc:" prefix identifies encrypted values
- Graceful fallback if crypto unavailable

SETUP WIZARD:
- Detect fresh installs needing configuration
- 3-step wizard: Infrastructure, Security, AI Services
- "/" redirects to wizard if setup required
- Auto-generate session_secret option
- Skip option for advanced users
- Beautiful UI with progress indicators

UI IMPROVEMENTS:
- Enhanced sensitive field display
- Lock icon showing encryption status
- Improved show/hide toggle for passwords
- Better visual hierarchy

FILES:
- app/utils/encryption.py - Encryption utilities
- app/utils/setup_wizard.py - Wizard detection logic
- app/views/wizard.py - Wizard routes
- frontend/templates/setup_wizard.html - Wizard UI
- requirements.txt - Added cryptography
- IMPLEMENTATION_CHECKLIST.md - Status tracking

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

frontend/templates/settings.html

@@ -29,7 +29,8 @@
       <p class="font-bold">⚠️ Important Notes:</p>
       <ul class="list-disc list-inside ml-4 mt-2">
         <li>Settings marked with <span class="text-red-600">*</span> require an application restart to take effect.</li>
-        <li>Sensitive values (passwords, API keys) are masked for security.</li>
+        <li>Sensitive values (passwords, API keys) are <strong>encrypted at rest</strong> in the database <i class="fas fa-lock text-xs"></i>.</li>
+        <li>Use the <i class="fas fa-eye"></i> icon to temporarily show/hide sensitive values.</li>
         <li>Saving a setting here stores it in the database and overrides environment variables.</li>
         <li>Only administrators can access and modify these settings.</li>
         <li>All fields are optional - you can save just the settings you want to override.</li>
@@ -108,22 +109,35 @@
               <!-- Text Input -->
               <div class="relative">
                 {% if setting.metadata.sensitive %}
-                <input 
-                  :type="showPassword['{{ setting.key }}'] ? 'text' : 'password'"
-                  id="{{ setting.key }}" 
-                  name="{{ setting.key }}"
-                  x-model="formData['{{ setting.key }}']"
-                  class="setting-input w-full px-3 py-2 pr-10 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-blue-500 focus:border-blue-500"
-                  placeholder="{{ setting.metadata.description }}"
-                />
-                <button 
-                  type="button"
-                  @click="togglePassword('{{ setting.key }}')"
-                  class="absolute inset-y-0 right-0 pr-3 flex items-center text-gray-400 hover:text-gray-600"
-                >
-                  <i :class="showPassword['{{ setting.key }}'] ? 'fas fa-eye-slash' : 'fas fa-eye'"></i>
-                </button>
+                <!-- Sensitive Field with Show/Hide Toggle -->
+                <div class="relative">
+                  <input 
+                    :type="showPassword['{{ setting.key }}'] ? 'text' : 'password'"
+                    id="{{ setting.key }}" 
+                    name="{{ setting.key }}"
+                    x-model="formData['{{ setting.key }}']"
+                    class="setting-input w-full px-3 py-2 pr-24 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-blue-500 focus:border-blue-500 font-mono text-sm"
+                    placeholder="{{ setting.metadata.description }}"
+                    autocomplete="off"
+                  />
+                  <div class="absolute inset-y-0 right-0 flex items-center pr-3 space-x-2">
+                    <!-- Encrypted indicator -->
+                    <span class="text-xs text-gray-400" title="Value is encrypted at rest in database">
+                      <i class="fas fa-lock"></i>
+                    </span>
+                    <!-- Show/Hide Toggle -->
+                    <button 
+                      type="button"
+                      @click="togglePassword('{{ setting.key }}')"
+                      class="text-gray-400 hover:text-gray-600 focus:outline-none"
+                      title="Show/hide value"
+                    >
+                      <i :class="showPassword['{{ setting.key }}'] ? 'fas fa-eye-slash' : 'fas fa-eye'"></i>
+                    </button>
+                  </div>
+                </div>
                 {% else %}
+                <!-- Non-Sensitive Field -->
                 <input 
                   type="text" 
                   id="{{ setting.key }}"