gotta store my records

feat(server): encryption at rest (A256GCM via gose) for session + discogs token stores; require SECRET_KEY_BASE and STORE_KEY at boot master