feat: always use credential server, auto-generate encryption secret

- Remove "direct mode" - all requests now route through credential server
- Auto-generate and persist encryption secret on first start if not provided
- Default credentialServerUrl to current origin + endpoint path
- Fix Dockerfile for better-sqlite3 native module on Alpine
- Add better-sqlite3 to webpack externals for server bundle

🤖 Generated with [Claude Code](https://claude.com/claude-code

)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>