Apply security remediations for FRE-4498 (FRE-4612)

Security findings from April 30 review were claimed fixed but never committed.
Applied all remediations:

HIGH:
- WebhookHandler: fail fast when DARKWATCH_WEBHOOK_SECRET missing instead of defaulting to hardcoded secret
- field-encryption.service: require PII_ENCRYPTION_KEY at startup instead of defaulting

MEDIUM:
- WebhookHandler: make signature required (was optional, accepted unsigned events)
- WebhookHandler: reject unknown event types instead of silently defaulting to SCAN_TRIGGER
- scheduler.routes + webhook.routes: add ownership checks on /:userId endpoints (IDOR)

LOW:
- webhook.routes: generic error responses, full error logged server-side

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/db/src/services/field-encryption.service.ts

@@ -1,6 +1,9 @@
 import crypto from 'crypto';
 
-const ENCRYPTION_KEY = process.env.PII_ENCRYPTION_KEY || 'default-32-byte-key-for-aes-256';
+if (!process.env.PII_ENCRYPTION_KEY) {
+  throw new Error("PII_ENCRYPTION_KEY environment variable is required — set it before starting the server");
+}
+const ENCRYPTION_KEY = process.env.PII_ENCRYPTION_KEY;
 const IV_LENGTH = 16;
 
 export class FieldEncryptionService {