feat(docker-watcher): phase 2 - crypto & config seed loader

AES-256-GCM encryption for credential storage, YAML seed config
parser with validation, and transactional import into SQLite.
Credentials (registry tokens, NPM password) encrypted before storage.

internal/store/store.go

@@ -51,6 +51,11 @@ func (s *Store) Close() error {
 	return s.db.Close()
 }
 
+// DB returns the underlying *sql.DB for advanced operations like transactions.
+func (s *Store) DB() *sql.DB {
+	return s.db
+}
+
 // migrate creates all tables if they do not already exist.
 func (s *Store) migrate() error {
 	_, err := s.db.Exec(schema)