feat(V1-API): implement TREX-Basic consumer API contract with encryption and persistence

- Add V1 API endpoints: assets, ledger, user-info
- Implement Fernet-based credential payload encryption (req-010)
- Extend health response schema with runtime info (req-004)
- Add service token runtime ID issuance (req-005)
- Implement database schema migration for V1 API (req-009)
- Add comprehensive test coverage for V1 endpoints
- Update SRS with 10 new requirements (REQ-004 through REQ-011)
- Create batch planning, design, and verification for BAT-001
- Integrate review-discovery StagePilot skill
- Update documentation indices and baseline specs

app/core/encryption.py

@@ -0,0 +1,26 @@
+"""Fernet symmetric encryption utilities for credential payloads."""
+
+from __future__ import annotations
+
+from cryptography.fernet import Fernet, InvalidToken  # noqa: F401 — re-exported for callers
+
+
+def make_fernet(key: str) -> Fernet:
+    """Return a Fernet instance from a base64-encoded key string."""
+    return Fernet(key.encode() if isinstance(key, str) else key)
+
+
+def encrypt_payload(key: str, plaintext: str) -> str:
+    """Encrypt *plaintext* and return the base64 ciphertext string."""
+    f = make_fernet(key)
+    return f.encrypt(plaintext.encode()).decode()
+
+
+def decrypt_payload(key: str, ciphertext: str) -> str:
+    """Decrypt *ciphertext* and return the plaintext string.
+
+    Raises ``cryptography.fernet.InvalidToken`` if the key is wrong or the
+    token is malformed.
+    """
+    f = make_fernet(key)
+    return f.decrypt(ciphertext.encode()).decode()