feat: Wave 2 — entities, security guards, API key encryption (15 files)

Entities:
- Create 5 new TypeORM entities: webstore_config, webstore_categories,
  webstore_items, webstore_transactions, module_store (all verified against live DB)
- Fix wipe-profile entity: remove incorrect default {} for pre/post wipe configs

Security:
- Add @RequirePermission guards to 7 controllers (36 endpoints total):
  team, webstore, notifications, alerts, analytics, settings, schedules
- Encrypt panel API key with AES-256-GCM in setup service (was plaintext)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-nest/src/entities/wipe-profile.entity.ts

@@ -15,10 +15,10 @@ export class WipeProfile {
   @Column({ type: 'text', nullable: true })
   description: string | null;
 
-  @Column({ type: 'jsonb', default: {} })
+  @Column({ type: 'jsonb' })
   pre_wipe_config: Record<string, any>;
 
-  @Column({ type: 'jsonb', default: {} })
+  @Column({ type: 'jsonb' })
   post_wipe_config: Record<string, any>;
 
   @Column({ type: 'timestamptz', default: () => 'NOW()' })