feat: 客户端加密 encrypted 字段，数据库只存密文 (v0.5.0)

- 新增 src/crypto.rs：AES-256-GCM 加解密 + Argon2id 密钥派生 + OS Keychain 读写
- 新增 `secrets init` 命令：输入 Master Password，派生 Master Key 存入 Keychain
- 新增 `secrets migrate-encrypt` 命令：将旧明文 JSONB 数据批量加密
- 修改 db.rs：encrypted 列 JSONB → BYTEA，新增 kv_config 表（存 Argon2id salt）
- 修改 models.rs：encrypted 字段类型 Value → Vec<u8>
- 修改 add/update：写入前 encrypt_json，update 读取后 decrypt → 合并 → 重新加密
- 修改 search：按需解密，未解密时显示 _encrypted:true/_key_count:N
- 通过 6 个 crypto 单元测试（加解密、JSON roundtrip、Argon2id 确定性）

Made-with: Cursor

Cargo.toml

@@ -1,13 +1,18 @@
 [package]
 name = "secrets"
-version = "0.4.0"
+version = "0.5.0"
 edition = "2024"
 
 [dependencies]
+aes-gcm = "0.10.3"
 anyhow = "1.0.102"
+argon2 = { version = "0.5.3", features = ["std"] }
 chrono = { version = "0.4.44", features = ["serde"] }
 clap = { version = "4.6.0", features = ["derive", "env"] }
 dirs = "6.0.0"
+keyring = { version = "3.6.3", features = ["apple-native"] }
+rand = "0.10.0"
+rpassword = "7.4.0"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.149"
 sqlx = { version = "0.8.6", features = ["runtime-tokio", "tls-rustls", "postgres", "uuid", "json", "chrono"] }