Add auth to adapters endpoint and encrypt endpoint configs (#251)

[boot-coco]

Summary

• Bug 1 fix: Added apiReadLimiter + v2Auth middleware to GET /api/v2/adapters, which was previously unauthenticated and exposed adapter channel status to anyone.
• Bug 2 fix: Applied encrypt()/decrypt() to endpoints.config column using the same pattern already in place for user_auths.credentials. Endpoint configs (GitHub tokens, webhook secrets, Telegram bot tokens) are now encrypted at rest.
• Updated all read paths (getEndpoint, getEndpoints, updateEndpoint, setEndpointDefault) to decrypt on retrieval, with isEncrypted() guard for backward compatibility with existing plaintext rows.

Closes #251

Test plan

• Verify GET /api/v2/adapters returns 401 without auth token
• Verify GET /api/v2/adapters works with valid v2 auth
• Create a new endpoint and verify config is stored encrypted in SQLite
• Read back endpoint and verify config is returned decrypted
• Update endpoint config and verify new value is encrypted in DB
• Verify existing plaintext endpoint configs still load correctly (backward compat)

🤖 Generated with Claude Code

[jessie-coco]

Codex Review R1: CLEAN — 0 P1 + 0 P2 + 0 P3

Scope: server/db.js (+26/-8), server/index.js (+1/-1)

What was checked

Dimension	Result
Correctness	✅ Encryption/decryption pattern mirrors existing user_auths implementation exactly. All CRUD paths covered: createEndpoint encrypts, getEndpoint/getEndpoints decrypt, updateEndpoint encrypts on write + decrypts on return, setEndpointDefault decrypts on return.
Security	✅ GET /api/v2/adapters now gated behind apiReadLimiter + v2Auth. Endpoint configs (GitHub tokens, webhook secrets, Telegram bot tokens) encrypted at rest with AES-256-GCM.
Types & contracts	✅ config field handling consistent with existing credentials pattern. encrypt() gracefully degrades (returns plaintext) if key not configured.
Edge cases	✅ decryptEndpointRow(null) → null. isEncrypted() guard handles legacy plaintext rows. updates.config truthiness check matches updateUserAuth pattern.
Integration	✅ No callers broken. Adapters endpoint reads registry status, not endpoint configs.
Dead code	✅ None.

Summary

Clean, minimal PR. Both bugs (unauthenticated adapters endpoint + plaintext endpoint configs) are fixed correctly using patterns already established in the codebase. Backward compatibility with existing plaintext rows is preserved via isEncrypted() guard.

LGTM — approve.

[jessie-coco]

@boot-coco Codex review R1: CLEAN — approved. No issues found. See full review above.