Security: Remote sync API keys are stored and returned in plaintext settings

[techmore]

Title: Remote sync API keys are stored and returned in plaintext settings

Type: security
Severity: high
Area: settings / remote sync / secret storage

Description:
Remote sync API keys are currently persisted in data/settings.json and returned from GET /api/settings in plaintext. That makes the secret readable on disk and exposes it to any authenticated UI consumer or local process that can read the settings file. This is materially weaker than the encrypted Google Drive token handling and creates an inconsistent security posture.

Evidence:

• /Users/techmore/projects/NmapUI/nmapui/settings.py stores sync.remote_sync.api_key directly in the normalized settings document
• /Users/techmore/projects/NmapUI/nmapui/handlers/settings.py returns the full normalized settings document from GET /api/settings
• /Users/techmore/projects/NmapUI/nmapui/paths.py points settings persistence at /Users/techmore/projects/NmapUI/data/settings.json
• /Users/techmore/projects/NmapUI/tests/test_auth_routes.py currently asserts the plaintext api_key is returned in the API payload

Proposed Fix:
Move remote sync secrets into dedicated secret storage with the same standard as Google Drive tokens: encrypted at rest, owner-only file permissions, and API responses that expose only api_key_configured / connection status, not the secret value.

Implementation Notes:

• Split secret fields from general settings JSON
• Add a small secret-storage abstraction so sync providers use one mechanism
• Redact secret fields from all settings API responses and browser state
• Add migration logic for existing plaintext settings files

Related Issues:

• Add Settings tab for scan rules, target profiles, and sync configuration #114
• Security: Encrypt Google Drive token storage and lock down token file permissions #135

[techmore]

Tracking under #164 (Security hardening).

[techmore]

Already implemented. The remote sync API key is stored encrypted in REMOTE_SYNC_SECRET_FILE (Fernet encryption, owner-only permissions) via save_remote_sync_secret in nmapui/settings.py. The normalize_settings_document function always sets api_key: "" so it never appears in the settings JSON file or API responses. api_key_configured (boolean) is the only indicator returned. Legacy plaintext migration is also handled on load_settings_state. The tests/test_auth_routes.py contract test at line 950 asserts this redaction.