security: encrypt sensitive DB fields, clean up dynamic import

Encrypt Proxmox server passwords and VM cloud-init passwords in the database:
- Add backend/app/crypto.py: Fernet-based encrypt/decrypt helpers + EncryptedString
  SQLAlchemy TypeDecorator (transparent to all existing code, no API changes)
- Add FERNET_KEY config field (env var); without it values stay plaintext for
  backward compatibility, with a logged warning
- Update models.py: ProxmoxServer.password and VMInstance.cloud_init_password
  now use EncryptedString(255) instead of String(255)
- Add migration 14 in migrations/migrations.py: idempotent re-encryption of
  existing plaintext rows (skipped when FERNET_KEY is not set)

CSRF analysis:
- /api/auth/change-password is protected by JWT Bearer token (Authorization header)
- Browsers cannot auto-include Authorization headers cross-site → CSRF is not
  applicable here; added explanatory comment

Improve migration loading:
- Add migrations/__init__.py to make it a proper Python package
- Replace fragile importlib dynamic loading in main.py with a standard import

https://claude.ai/code/session_019rK2wvaWg5zXFwmAPPEB7R

backend/.env.example

@@ -32,6 +32,12 @@ ALLOWED_HOSTS=localhost,127.0.0.1
 # IMPORTANT: Change this before first deployment!
 ADMIN_PASSWORD=admin123
 
+# Fernet encryption key for sensitive DB fields (Proxmox passwords, cloud-init passwords).
+# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+# WARNING: Keep this key safe — losing it means losing access to encrypted passwords.
+# If not set, passwords are stored as plaintext (insecure).
+FERNET_KEY=
+
 # Update Check Configuration
 # Note: DISABLE_UPDATE_CHECK and GITHUB_TOKEN are managed via root .env
 # (see ../.env.example) and passed in docker-compose. Uncomment below only