Add phase 5 secure credential vault

app/core/settings.py

@@ -14,6 +14,8 @@ class Settings(BaseSettings):
     ENV: str = "dev"
     DEBUG: bool = True
     SECRET_KEY: str = "change-me-to-a-long-random-string"
+    # Separate high-entropy key for tenant-scoped credential encryption. Never rotate without a re-encryption plan.
+    VAULT_MASTER_KEY: str = ""
 
     COOKIE_SECURE: bool = False
     COOKIE_SAMESITE: str = "lax"

app/core/startup.py

@@ -27,6 +27,7 @@ from app.modules.notice_cases.models import NoticeCase, NoticeCaseEvent, NoticeC
 from app.modules.notifications.automation import start_notification_scheduler
 from app.modules.registrations.service import seed_registration_types
 from app.modules.registrations import models as registration_models  # noqa: F401
+from app.modules.credential_vault import models as credential_vault_models  # noqa: F401
 
 DEFAULT_ROLES = [
     "System Admin",