Feature: Encrypt Provider API keys

[ndaidong]

I noticed that Providers' API keys are currently being stored directly in the database without encryption. This is risky because anyone with database access (or who gains access) could retrieve the raw secrets.

Proposal:

• Encrypt API keys before persisting them to the database.
• Decrypt the keys at runtime and keep the decrypted value only in memory when needed.
• Add a new configuration/environment variable (e.g., API_KEYS_SECRET) that the user can set to the secret used for encryption/decryption.

With these changes, setting providers in the UI will be far superior to using config.yaml or environment variables, because there’s no need to define the keys in plain text.

How do you think about this?

[SantiagoDePolonia]

It totally makes sense.

However I will treat it as a medium priority.

Storing keys in the DB is optional-passing the providers' API keys via environment variables and keeping them in a vault is the recommended approach.

PS If you find GoModel useful, feel free to voluntarily sponsor its development: https://github.com/sponsors/ENTERPILOT