fix(security): harden encryption key permissions, increase password minimum, remove sensitive logs (#323)

Self-heal encryption key file permissions to 0600 on startup. Increase
minimum password length from 6 to 8 characters per NIST SP 800-63B.
Remove console.log statements that exposed file paths, .env locations,
stack names, and admin usernames to stdout.

backend/src/services/CryptoService.ts

@@ -17,6 +17,16 @@ export class CryptoService {
 
         if (fs.existsSync(keyPath)) {
             this.key = Buffer.from(fs.readFileSync(keyPath, 'utf-8').trim(), 'hex');
+            // Self-heal permissive file permissions (no-op on Windows)
+            try {
+                const mode = fs.statSync(keyPath).mode & 0o777;
+                if (mode !== 0o600) {
+                    console.warn(`[CryptoService] Fixing permissive key file permissions (was 0o${mode.toString(8)}, set to 0o600)`);
+                    fs.chmodSync(keyPath, 0o600);
+                }
+            } catch {
+                // chmod not supported on this platform (e.g. Windows) — skip
+            }
         } else {
             this.key = crypto.randomBytes(KEY_LENGTH);
             if (!fs.existsSync(dataDir)) {