Access tokens stored in plaintext in Postgres

[Prasanth-Shakti]

authenticated_users.access_token TEXT NOT NULL — no encryption at rest. A DB dump/leak hands over live GitHub tokens for every private-access user. Worth encrypting the column (e.g., via pgcrypto or app-level envelope encryption) given how sensitive these tokens are.