feat(migration): encrypted credential vault for source-PMS tokens (TEL-70)

[telivity-otaip]

Summary

Implements an encrypted at-rest credential vault for tier-1 source-PMS migration connectors (Mews, Cloudbeds, Apaleo, OHIP). Unlike channel_connections.config, credentials are AES-256-GCM encrypted before persistence.

Changes

• Crypto helper (apps/api/src/common/crypto/credential-encryption.ts): AES-256-GCM encrypt/decrypt keyed by MIGRATION_CREDENTIAL_ENCRYPTION_KEY, with rotation seam via encryption_key_id and optional MIGRATION_CREDENTIAL_ENCRYPTION_KEYS JSON map
• Schema: migration_source_credentials table — property_id, source_pms, ciphertext, encryption_key_id, audit timestamps; unique per property + source PMS
• Service (MigrationSourceCredentialsService): upsert, listMetadata, decryptForRunner (server-side only), delete (per-source or all-for-property)
• HTTP API (/api/v1/migration/credentials): metadata-only responses; no endpoint returns decrypted secrets
• Deletion: DELETE /migration/credentials/:sourcePms and DELETE /migration/credentials for migration completion / GDPR erasure
• Audit: redacted metadata only — no credential values or ciphertext in audit rows

Acceptance criteria

• Credentials at rest are ciphertext; round-trip works; wrong-key fails closed
• No credential value in API responses, logs, or audit rows
• Tests include GCM tamper detection (auth tag + ciphertext)

Env vars (.env.example)

MIGRATION_CREDENTIAL_ENCRYPTION_KEY=        # openssl rand -hex 32
MIGRATION_CREDENTIAL_ENCRYPTION_KEY_ID=default
MIGRATION_CREDENTIAL_ENCRYPTION_KEYS=       # optional rotation map

Testing

pnpm build
DATABASE_URL=postgresql://haip:haip@localhost:5432/haip_test pnpm db:migrate
pnpm --filter @telivityhaip/api test -- migration
pnpm --filter @telivityhaip/api vitest run src/common/crypto/credential-encryption.spec.ts

Closes TEL-70

Linear Issue: TEL-70