fix(docker-watcher): address final review findings

Security:
- Move config export behind auth middleware
- Validate OIDC callback token before storing in localStorage
- Use constant-time comparison for webhook secret
- Encrypt OIDC client secret at rest (like registry tokens)

Performance:
- Make TriggerDeploy async from HTTP handlers (return deploy ID
  immediately, run pipeline in background goroutine)

Robustness:
- Wrap api.ts res.json() in try/catch for non-JSON responses

i18n:
- Replace ~20 hardcoded English validation messages with $t() calls
- Localize ConfirmDialog cancel button, InstanceCard confirm titles,
  ProjectCard instance/instances pluralization
- Add validation keys to both en.json and ru.json

internal/api/router.go

@@ -7,6 +7,7 @@ import (
 	"github.com/go-chi/chi/v5"
 
 	"github.com/alexei/docker-watcher/internal/auth"
+	"github.com/alexei/docker-watcher/internal/crypto"
 	"github.com/alexei/docker-watcher/internal/docker"
 	"github.com/alexei/docker-watcher/internal/events"
 	"github.com/alexei/docker-watcher/internal/store"
@@ -57,10 +58,18 @@ func NewServer(
 
 // initOIDCProvider creates an OIDC provider from settings. Errors are logged, not fatal.
 func (s *Server) initOIDCProvider(ctx context.Context, as store.AuthSettings) {
+	// Decrypt the OIDC client secret if it's encrypted.
+	clientSecret := as.OIDCClientSecret
+	if clientSecret != "" {
+		if decrypted, err := crypto.Decrypt(s.encKey, clientSecret); err == nil {
+			clientSecret = decrypted
+		}
+		// If decrypt fails, assume it's already plaintext (migration scenario).
+	}
 	provider, err := auth.NewOIDCProvider(ctx, auth.OIDCConfig{
 		IssuerURL:    as.OIDCIssuerURL,
 		ClientID:     as.OIDCClientID,
-		ClientSecret: as.OIDCClientSecret,
+		ClientSecret: clientSecret,
 		RedirectURL:  as.OIDCRedirectURL,
 	})
 	if err != nil {
@@ -90,13 +99,13 @@ func (s *Server) Router() chi.Router {
 		// Webhook handler (uses its own secret-based auth).
 		r.Mount("/webhook", s.webhook.Route())
 
-		// Config export (public endpoint, useful for backup).
-		r.Get("/config/export", s.exportConfig)
-
 		// Protected routes: require valid JWT.
 		r.Group(func(r chi.Router) {
 			r.Use(auth.Middleware(s.localAuth))
 
+			// Config export (protected — reveals project/infra details).
+			r.Get("/config/export", s.exportConfig)
+
 			// Auth management.
 			r.Get("/auth/me", s.currentUser)
 			r.Get("/auth/settings", s.getAuthSettings)