feat: Wave 2 — entities, security guards, API key encryption (15 files)

Entities:
- Create 5 new TypeORM entities: webstore_config, webstore_categories,
  webstore_items, webstore_transactions, module_store (all verified against live DB)
- Fix wipe-profile entity: remove incorrect default {} for pre/post wipe configs

Security:
- Add @RequirePermission guards to 7 controllers (36 endpoints total):
  team, webstore, notifications, alerts, analytics, settings, schedules
- Encrypt panel API key with AES-256-GCM in setup service (was plaintext)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-nest/src/modules/schedules/schedules.controller.ts

@@ -16,6 +16,7 @@ import {
 } from '@nestjs/swagger';
 import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
 import { CurrentTenant } from '../../common/decorators/current-tenant.decorator';
+import { RequirePermission } from '../../common/decorators/require-permission.decorator';
 import { SchedulesService } from './schedules.service';
 import { CreateTaskDto } from './dto/create-task.dto';
 import { UpdateTaskDto } from './dto/update-task.dto';
@@ -28,6 +29,7 @@ export class SchedulesController {
   constructor(private readonly schedulesService: SchedulesService) {}
 
   @Get('tasks')
+  @RequirePermission('schedules.view')
   @ApiOperation({
     summary: 'Get all scheduled tasks',
     description: 'Returns all scheduled tasks for this license',
@@ -41,6 +43,7 @@ export class SchedulesController {
   }
 
   @Post('tasks')
+  @RequirePermission('schedules.manage')
   @ApiOperation({
     summary: 'Create a scheduled task',
     description: 'Create a new scheduled task (restart, announcement, command, or plugin reload)',
@@ -61,6 +64,7 @@ export class SchedulesController {
   }
 
   @Put('tasks/:id')
+  @RequirePermission('schedules.manage')
   @ApiOperation({
     summary: 'Update a scheduled task',
     description: 'Update task configuration, schedule, or settings',
@@ -82,6 +86,7 @@ export class SchedulesController {
   }
 
   @Delete('tasks/:id')
+  @RequirePermission('schedules.manage')
   @ApiOperation({
     summary: 'Delete a scheduled task',
     description: 'Remove a scheduled task and unregister from scheduler',