security: critical auth fixes, test migration to SQLite+FK, 44 test fixes

CRITICAL (CVE-class):
- C-4: Remove DEV_MODE fallback with hardcoded postgres:postgres credentials
- C-3: WebSocket endpoints now require JWT or API key token (?token=) auth
- C-1: Superset environment passwords encrypted via Fernet at rest in DB
- H-4: SESSION_SECRET_KEY separated from JWT AUTH_SECRET_KEY
- H-1: Log injection via %s-formatting instead of f-strings
- H-5: X-Trace-ID header validated as UUID4 to prevent trace poisoning

INFRASTRUCTURE:
- New src/core/encryption.py — EncryptionManager extracted from llm_provider
- Test DB: per-module sqlite:///:memory: with PRAGMA foreign_keys=ON
- testcontainers PostgreSQL via TEST_DB=postgres env var
- conftest temp-file global engine (no 10GB shared-cache leak)

TEST FIXES (44 pre-existing → 0):
- test_smoke_plugins: module-level sys.modules mock isolated to per-test fixture
- test_migration_engine: EXT:Python:uuid → uuid syntax fix
- test_dashboards_api: mock env attributes + correct patch target
- test_constants_audit_fixes: sync expected constant names with actual
- test_defensive_guards: patch.object instead of module-level Repo mock
- test_clean_release_cli: removed empty config.json directory
- FK violations: TaskRecord parents in log_persistence, Environment in
  mapping_service, ReleaseCandidate in candidate_manifest_services

ORTHOGONAL TESTS (18 new):
- test_security_orthogonal.py: bcrypt 72-byte limit, unicode, API key
  format invariants, Fernet robustness, encryption key lifecycle,
  log injection protection, JWT edge cases

MODEL FIXES:
- MetricSnapshot.job_id: nullable with SET NULL (was broken FK for
  aggregate prune snapshots, hidden by SQLite)

CLEANUP:
- Removed stale :memory:test_main/test_auth/test_tasks file databases
- Removed duplicate #endregion in encryption_key.py

backend/tests/test_log_persistence.py

@@ -29,6 +29,8 @@ class TestLogPersistence:
     def setup_class(cls):
         """Create an in-memory database for testing."""
         cls.engine = create_engine("sqlite:///:memory:")
+        from sqlalchemy import event
+        event.listen(cls.engine, "connect", lambda c, _: c.execute("PRAGMA foreign_keys=ON"))
         Base.metadata.create_all(bind=cls.engine)
         cls.TestSessionLocal = sessionmaker(bind=cls.engine)
         cls.service = TaskLogPersistenceService()
@@ -50,8 +52,17 @@ class TestLogPersistence:
     # @POST: task_logs table is empty.
     def setup_method(self):
         """Clean task_logs table before each test."""
+        from src.models.task import TaskLogRecord, TaskRecord
         session = self.TestSessionLocal()
-        from src.models.task import TaskLogRecord
+        # Create FK parent records for all task_ids used in tests
+        for tid in ['test-task-1', 'test-task-2', 'test-task-3', 'test-task-4',
+                     'test-task-5', 'test-task-6', 'test-task-7', 'test-task-8',
+                     'test-task-9', 'multi-1', 'multi-2', 'multi-3']:
+            existing = session.query(TaskRecord).filter(TaskRecord.id == tid).first()
+            if not existing:
+                session.add(TaskRecord(id=tid, type='test', status='PENDING'))
+        session.commit()
+        # Clean task_logs table
         session.query(TaskLogRecord).delete()
         session.commit()
         session.close()