AES-256-GCM encryption (KeyCipher) with master key from NEXUS_MASTER_KEY, never persisted. ProvidersStore in SQLite: CRUD, enable/disable, default, encrypted api keys, masked views for UI. KeyResolver applies env>DB precedence and supports multiple providers. context.ts registers providers dynamically from resolved config; backward compatible with env-only setups.