fix(secrets): store ops-created secrets encrypted via createSecret (security)

The ops 'Add Secret' modal wrote the secret value straight to the DB from the
browser in PLAINTEXT — despite the 'Stored encrypted at rest' label — because
the AES key is server-only. Route it through the createSecret server action,
which encrypts the value (AES-256-GCM), enforces the admin/board gate, validates
input, and logs the activity. Existing plaintext rows (encryption_version 0)
still reveal correctly; new secrets are encrypted when a key is configured.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

app/(app)/ops/ops-client.tsx

@@ -208,7 +208,6 @@ export function OpsClient({ spaceId, kbEntries: initial, areaLeads: initialLeads
         <AddSecretModal
           onClose={() => setShowSecretModal(false)}
           onSaved={s => setSecrets(prev => [s, ...prev])}
-          spaceId={spaceId}
         />
       )}
       {showLeadModal && (