fix(security): harden encryption key permissions, increase password minimum, remove sensitive logs (#323)

Self-heal encryption key file permissions to 0600 on startup. Increase
minimum password length from 6 to 8 characters per NIST SP 800-63B.
Remove console.log statements that exposed file paths, .env locations,
stack names, and admin usernames to stdout.

backend/src/services/DatabaseService.ts

@@ -473,7 +473,7 @@ export class DatabaseService {
         this.db.prepare(
             'INSERT INTO users (username, password_hash, role, created_at, updated_at) VALUES (?, ?, ?, ?, ?)'
         ).run(username, passwordHash, 'admin', now, now);
-        console.log(`Migrated admin user "${username}" to users table.`);
+        console.log('Migrated legacy admin user to users table.');
     }
 
     private migrateJsonConfig(dataDir: string) {