Community signing and rotation keys were stored as plaintext in the community_settings table. These keys control the community's AT Protocol identity -- a database leak would allow DID takeover. Add application-level encryption using AES-256-GCM with HKDF key derivation from the AI_ENCRYPTION_KEY environment variable (KEK). Keys are now encrypted before DB write in the setup service.