fix(dkv): return username in GET /dkv/config response

loadConfig used CONFIG_SAFE_SELECT which excludes encryptedInboxCreds entirely,
so username was never returned to the frontend — form always showed empty username.

Added getConfigForApi() which loads the safe config + decrypts encryptedInboxCreds
to extract username (never password) and adds hasPassword boolean. Controller
getConfig now calls getConfigForApi instead of loadConfig.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/dkv/dkv.controller.ts

@@ -55,12 +55,12 @@ export class DkvController {
 
   // ─── Config ────────────────────────────────────────────────────────────────
 
-  /** GET /dkv/config — returns module config without encrypted credentials. 404 when not yet configured. */
+  /** GET /dkv/config — returns module config with username + hasPassword. 404 when not yet configured. */
   @Get('config')
   @Roles(Role.ADMIN, Role.SUPER_ADMIN)
   async getConfig(@Req() req: any) {
     const tenantId = this._requireTenant(req);
-    const config = await this.dkvService.loadConfig(tenantId);
+    const config = await this.dkvService.getConfigForApi(tenantId);
     if (!config) {
       throw new NotFoundException('DKV module not yet configured');
     }