feat(creds): livrare creds per-cerere la worker (criptat efemer + sesiuni per-cont)

Plan sect.5: parola RAR vine per-cerere, stocata CRIPTATA in submission pana la
primul login reusit pe cont, apoi stearsa; JWT 30h acopera restul.

- app/crypto.py: Fernet, cheie din AUTOPASS_creds_key (nesetata -> efemera la
  runtime, creds nu supravietuiesc restartului). encrypt/decrypt_creds.
- schema + migrare: submissions.rar_creds_enc (creds criptate).
- ingestie: cripteaza rar_credentials, le lipeste de fiecare submission nou.
  Niciodata in clar in DB.
- worker: AccountSessions (login per-cont cu creds decriptate, cache JWT in
  memorie, sterge creds-urile contului dupa primul login + refresh nomenclator).
  401 creds gresite -> error fara retry; token expirat -> invalidare + requeue;
  fara creds (restart) -> requeue "indisponibile" (ROAAUTO re-trimite).
  claim_one intoarce account_id + creds_enc; recover_orphans filtrabil pe cont.
- requirements: cryptography==46.0.5.

Nota: refresh nomenclator e acum lazy la primul login per-cont (nu la pornire);
seed-ul fallback acopera editorul offline.

10 teste noi (tests/test_creds_delivery.py). 95 pass total.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/config.py

@@ -28,6 +28,12 @@ class Settings(BaseSettings):
     # dar invalida da 401 indiferent de flag.
     require_api_key: bool = False
 
+    # Cheie Fernet pentru criptarea creds RAR efemere in submissions (zero-storage
+    # at rest). Nesetata -> cheie efemera la runtime (creds nu supravietuiesc
+    # restartului). In productie seteaz-o persistent. Genereaza:
+    #   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+    creds_key: str | None = None
+
     # --- RAR ---
     rar_env: str = "test"  # "test" | "prod"
     rar_base_url_test: str = "https://apps.rarom.ro/test-rar-autopass"