Authenticated encryption for enterprise secrets (#1078)

app/MindWork AI Studio/Settings/DataModel/DataApp.cs

@@ -315,6 +315,17 @@ public sealed class DataApp(Expression<Func<Data, DataApp>>? configSelection = n
     /// </summary>
     public bool ShowAdminSettings { get; set; } = ManagedConfiguration.Register(configSelection, n => n.ShowAdminSettings, false);
 
+    /// <summary>
+    /// In which format do exports encrypt API keys, tokens, and passwords with the enterprise encryption secret?
+    /// </summary>
+    /// <remarks>
+    /// New installations write the authenticated format v2. Installations which existed before
+    /// v26.10.1 keep writing v1, which older versions read as well: large organizations package
+    /// updates themselves, so their administrators run a new version weeks before everybody else.
+    /// SettingsManager tells the two kinds of installations apart.
+    /// </remarks>
+    public EnterpriseEncryptionFormat EnterpriseEncryptionExportFormat { get; set; } = ManagedConfiguration.Register(configSelection, n => n.EnterpriseEncryptionExportFormat, EnterpriseEncryptionFormat.V2);
+
     /// <summary>
     /// Should AI answers which are copied or exported end with a notice that AI generated them?
     /// </summary>

app/MindWork AI Studio/Settings/DataModel/DataSourceERI_V1.cs

@@ -391,7 +391,7 @@ public readonly record struct DataSourceERI_V1 : IERIDataSource
 
         if (!EnterpriseEncryption.IsEncrypted(encryptedSecret))
         {
-            LOGGER.LogWarning($"The configured data source {idx} contains a plaintext {secretFieldName}. Only encrypted secrets (starting with 'ENC:v1:') are supported. (Plugin ID: {configPluginId})");
+            LOGGER.LogWarning($"The configured data source {idx} contains a plaintext {secretFieldName}. Only encrypted secrets (starting with 'ENC:') are supported. (Plugin ID: {configPluginId})");
             return false;
         }
 

app/MindWork AI Studio/Settings/DataModel/DataTools.cs

@@ -61,10 +61,10 @@ public sealed class DataTools(Expression<Func<Data, DataTools>>? configSelection
     /// known at compile time, yet an organization has to be able to configure them the same way.
     /// <br/><br/>
     /// A secret field travels here too, but only encrypted with the enterprise secret, in the
-    /// same "ENC:v1:" form the providers use for their API keys. What is stored is therefore
-    /// ciphertext, worthless without a secret that lives outside every deployed file. A plaintext
-    /// secret is refused rather than used, and a secret is never accepted as a pre-filled default
-    /// — see the tool settings service for both rules.
+    /// same "ENC:v2:" or "ENC:v1:" form the providers use for their API keys. What is stored is
+    /// therefore ciphertext, worthless without a secret that lives outside every deployed file. A
+    /// plaintext secret is refused rather than used, and a secret is never accepted as a
+    /// pre-filled default — see the tool settings service for both rules.
     /// </remarks>
     public Dictionary<string, string> LockedToolSettings { get; set; } = ManagedConfiguration.Register(
         configSelection,