Add managed provider keys: encrypted store + env>DB resolver

AES-256-GCM encryption (KeyCipher) with master key from NEXUS_MASTER_KEY,
never persisted. ProvidersStore in SQLite: CRUD, enable/disable, default,
encrypted api keys, masked views for UI. KeyResolver applies env>DB precedence
and supports multiple providers. context.ts registers providers dynamically
from resolved config; backward compatible with env-only setups.

NexusAI/.env.example

@@ -14,6 +14,16 @@ NEXUS_EMBED_MAX_BYTES=10485760
 # Log level: debug | info | warn | error (logs go to stderr)
 NEXUS_LOG_LEVEL=info
 
+# --- Managed provider keys (optional, for admin-managed keys) ---
+# Master secret used to encrypt provider API keys stored in SQLite (AES-256-GCM).
+# Accepts a 64-char hex string or any passphrase. NEVER stored in the DB.
+# If unset, only env keys (e.g. NORDROUTER_API_KEY) are used.
+# Generate: openssl rand -hex 32
+# NEXUS_MASTER_KEY=
+# Optional separate DB for the providers store (defaults to NEXUS_DB_PATH)
+# NEXUS_PROVIDERS_DB_PATH=./media-output/nexus.sqlite
+# Key precedence: <NAME>_API_KEY env  >  encrypted DB entry
+
 # --- Local STT (faster-whisper via uv sidecar) ---
 # Launcher: "uv" (recommended, auto-installs deps) or a python interpreter path
 NEXUS_STT_PYTHON=uv