[Security] Encrypt API keys at rest and fix SSRF

[d-oit]

Problem

1. API keys stored in plaintext localStorage (any XSS can steal them)
2. SSRF in URL resolution — no private IP blocking
3. No URL scheme validation (file://, javascript: allowed)

Solution

API Key Encryption

• Use Web Crypto API (AES-GCM) to encrypt keys at rest
• Generate encryption key on first use
• Migrate existing plaintext keys

SSRF Protection

• Block localhost, 127.0.0.1, private IPs
• Validate URL scheme (http/https only)
• Add error messages for blocked URLs

Files

• src/lib/llm/config.ts — encryption
• src/lib/llm/encryption.ts (new)
• src/lib/resolver.ts — URL validation

Acceptance Criteria

• API keys encrypted in localStorage
• Decryption works correctly
• Private IPs blocked
• Non-HTTP schemes blocked
• Migration handles existing keys

Priority

High — Security vulnerability.

Plan

See plans/37-security-quality-hardening.md Tasks 37.1, 37.2

[google-labs-jules]

Jules has failed to create a task. You can try again later by removing and re-adding the 'jules' label.