feat: surface per-user credentials to feed source providers (#110)

Add credentials parameter to FeedSourceProvider.feedSourceForUser so
providers can receive decrypted per-user credentials (OAuth tokens,
passwords) from the user_sources table.

Wire CredentialEncryptor into UserSessionManager to handle
encrypt/decrypt. Providers receive plaintext and handle validation
internally. Existing providers ignore the new parameter.

Co-authored-by: Ona <no-reply@ona.com>

apps/aelis-backend/src/location/provider.ts

@@ -5,7 +5,11 @@ import type { FeedSourceProvider } from "../session/feed-source-provider.ts"
 export class LocationSourceProvider implements FeedSourceProvider {
 	readonly sourceId = "aelis.location"
 
-	async feedSourceForUser(_userId: string, _config: unknown): Promise<LocationSource> {
+	async feedSourceForUser(
+		_userId: string,
+		_config: unknown,
+		_credentials: unknown,
+	): Promise<LocationSource> {
 		return new LocationSource()
 	}
 }