feat(deploy): webhook queue+nocache, restart sweep, secrets at rest

- Webhook-triggered deploys now go through the per-service deploy queue
  and default to no_cache builds (dflow convention — prevents stale
  layer surprises on push).
- Boot sweep marks deployments interrupted by restart as failed instead
  of leaving phantom queued/building rows.
- is_secret environment variables are AES-GCM-encrypted at rest
  (enc:v1: prefix); key from SECRETS_KEY or JWT_SECRET fallback.
  Existing plaintext secrets encrypt on boot; deploy/exec paths decrypt
  transparently. Masked-echo writes preserve stored ciphertext.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/api/runtime.go

@@ -12,6 +12,7 @@ import (
 	"containr/internal/database"
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
+	"containr/internal/secrets"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -79,7 +80,7 @@ func resolveServiceEnv(db *database.DB, service Service) (map[string]string, err
 		if err := rows.Scan(&k, &v); err != nil {
 			return nil, err
 		}
-		env[k] = v
+		env[k] = secrets.Decrypt(v)
 	}
 
 	var refServices []struct{ ID, Name string }
@@ -127,7 +128,7 @@ func resolveServiceEnv(db *database.DB, service Service) (map[string]string, err
 		if err != nil {
 			return "", false
 		}
-		return value, true
+		return secrets.Decrypt(value), true
 	}
 
 	for k, v := range env {