feat: add secret manager, tool registry, idempotency middleware, and …

[dev-chinasa]

closes #437
closes #438
closes #440
closes #441

PR Description

Summary

• Adds initial, focused implementations to address the four high-priority backend tasks: encrypted secret handling, governed tool registry, durable idempotency, and observability propagation. These are scaffolds designed for immediate protection and operability; they’re intentionally minimal and safe to expand/integrate with production KMS/DB/Redis later.

What I changed

• Secrets (encrypted-at-rest store + migration script): Added a simple encrypted store using AES-256-GCM and a migration helper.

  • Files: secretManager.ts, migrate_secrets.ts
  • Behavior: secrets are stored encrypted in data/secrets.json; SECRET_MASTER_KEY env var is used for encryption. Migration reads data/plain_secrets.json and writes encrypted entries.

• Tool registry (governed capability registry): Added a metadata-backed registry with versioning, deprecation flags, and startup validation.

  • Files: toolRegistry.ts
  • Behavior: registry persisted to data/tool_registry.json. Startup validation logs warnings for duplicates/deprecations.

• Idempotency framework (durable replay-safe semantics): Added file-backed idempotency store and Express middleware to provide replay-safety for mutating requests.

  • Files: idempotency.ts
  • Behavior: middleware reads Idempotency-Key header for POST/PUT/PATCH; replays stored responses or persists responses for later replay. Store persisted to data/idempotency.json.

• Observability (propagation helpers): Added helper for injecting correlation/tracing headers into outgoing calls and leveraged existing context utilities.

  • Files: outgoing.ts
  • Behavior: injectTracingHeaders() returns the correlation headers to forward to downstream tools/HTTP/LLM/blockchain calls.

• Wiring / Startup:

  • Initialized the secret manager and validated registry at startup.
  • Enabled idempotency middleware in the API pipeline for mutating requests.
  • Files modified: index.ts, api.ts