fix: address PR #1 security review — drop platform seeds, seal db passwords

- Remove managed connection seeding: platform-postgres/dragonfly carried
  the backend's own DATABASE_URL/DRAGONFLY_URL into tenant projects where
  any member could run arbitrary DBX queries against core tables
  (Codex P1). NewPlatformService loses the seeds param; firstPartyDBSeeds
  deleted.
- Seal db_connections passwords with the existing AES-256-GCM encryptor
  (enc:v1:<b64> marker); decrypted only in dbxArgsFor. Legacy plaintext
  values still read, but migration 00008 strips them (Codex P1).
- Migration 00008: delete is_managed rows, drop plaintext password keys.
- dbxConnectionName uses the full project UUID — the 8-hex prefix could
  collide and alias another project's credentials (Codex P2).
- ci.yml triggers on master, not the nonexistent main/develop branches.
- demo-mode stubs renamed to user-managed connections; CHANGELOG notes
  under Unreleased.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/frontend/src/lib/demo-mode.ts

@@ -340,27 +340,27 @@ let dbConnections: DBConnection[] = [
   {
     id: "dbc-1",
     project_id: "proj-1",
-    name: "platform-postgres",
+    name: "warehouse",
     db_type: "postgres",
-    host: "postgres",
+    host: "db.example.internal",
     port: 5432,
-    database: "primora",
-    username: "primora",
-    ssl: null,
-    is_managed: true,
+    database: "analytics",
+    username: "primora_read",
+    ssl: true,
+    is_managed: false,
     has_password: true,
   },
   {
     id: "dbc-2",
     project_id: "proj-1",
-    name: "platform-dragonfly",
+    name: "cache",
     db_type: "redis",
-    host: "dragonfly",
+    host: "redis.example.internal",
     port: 6379,
     database: "",
     username: "",
     ssl: null,
-    is_managed: true,
+    is_managed: false,
     has_password: false,
   },
 ];