feat: encrypt stored service credentials

app/security/credentials.py

@@ -0,0 +1,20 @@
+from cryptography.fernet import Fernet, InvalidToken
+
+
+class CredentialCipher:
+    def __init__(self, key: str) -> None:
+        try:
+            self._fernet = Fernet(key.encode("ascii"))
+        except Exception as exc:
+            raise ValueError("CREDENTIAL_ENCRYPTION_KEY must be a valid Fernet key") from exc
+
+    def encrypt(self, value: str) -> str:
+        if not value:
+            raise ValueError("credential value must not be empty")
+        return self._fernet.encrypt(value.encode("utf-8")).decode("ascii")
+
+    def decrypt(self, token: str) -> str:
+        try:
+            return self._fernet.decrypt(token.encode("ascii")).decode("utf-8")
+        except InvalidToken as exc:
+            raise ValueError("stored credential cannot be decrypted") from exc