Initiative: Security hardening

[techmore]

Goal\nReduce attack surface and secure secrets/configuration.\n\n## Scope\n- Enforce auth on runtime endpoints when exposed\n- Store remote sync credentials securely and avoid plaintext handling\n- Add tests for auth enforcement and secret handling\n\n## Related Issues\n- #157 Require auth for runtime status/log endpoints when bound beyond localhost\n- #141 Security: Remote sync API keys are stored and returned in plaintext settings