ADR-0067: partner client secret typed in through the registry, stored encrypted in fm_db

ADR-0067 lets FM store a partner client secret that the operator types in through the registry, AES-256-GCM encrypted in fm_db, next to the existing mounted-file reference. Implementation: federation-manager#28, federation-manager MR on feat/partner-typed-secret.

Why: the portal registers partners from a browser and can't create a file inside FM's container, so a partner registered there could never go active without someone mounting the secret by hand.

What the docs said before and what changes:

Where	Before	After
fm/overview-and-architecture.md, outbound credentials	secret only in a mounted file, never in fm_db	mounted file or typed value stored encrypted, never returned
fm/implementation-and-delivery.md, outbound adapter, security point 5, test plan, risk table, delivery step 3	fm_db stores only our_client_secret_ref	either source; key FM_PARTNER_SECRET_KEY, 501 without it; tests check the secret never appears unencrypted
fm/requirements-and-design.md, partner_ops	"secret is never stored inline"	one source per partner, plus the new partner_op_secrets table

Same approach OEG already took for callback tokens (ADR-0063): one app-wide key, fresh nonce per value, no rotation, 501 when unconfigured. It also amends FM #21's done-criterion, "no secret value is accepted, stored, returned or logged": accepted and stored (encrypted) now, still never returned or logged.