feat(fm): accept the partner client secret by value, stored encrypted

The portal registers partners from a browser and can't mount a secret file
into FM's container. POST/PATCH /internal/partners now take our_client_secret:
FM encrypts it with AES-256-GCM under FM_PARTNER_SECRET_KEY into
partner_op_secrets and only reports our_client_secret_set. our_client_secret_ref
still works; a partner uses one or the other. Without a key, a request
carrying a secret gets 501.