feat(secret): encrypt secret metadata at rest

[yagmurcicekdagi]

Fixes: #251

• Encrypt secret metadata at rest by storing encrypted fields and a metadata nonce in secret_metadata.
• Update SQL schema and queries to handle encrypted metadata columns and nonce, with correct insert/update semantics.
• Decrypt metadata on load and decode fields back to ints/timestamps.
• Adjust tests/helpers to insert encrypted metadata