Protect personal provider credentials and usage budgets

[stef-k]

Summary

• add protected per-user location-provider profiles with independent geocoding and routing authorization, selection, verification, replacement, and revocation
• migrate exact legacy Mapbox credentials non-destructively while masking provider secrets across user, manager, and administrator surfaces
• add durable Geoapify rolling-credit admission and independent Mapbox Permanent Geocoding and Directions safety meters
• preserve the existing Data Protection application discriminator and document the durable key-ring backup/restore contract

Database and deployment notes

• adds AddPersonalLocationProviderFoundation and EnforcePersonalProviderSelectionIntegrity EF migrations
• does not delete Locations, Timeline data, Trips, Segment geometry, stored enrichment, routing credentials, unrelated API tokens, or provider usage
• legacy Mapbox migration is authenticated, lazy, exact-name only, readback-verified, and fail-closed on conflicts or unreadable ciphertext
• deployers must preserve and back up /home/wayfarer/.aspnet/DataProtection-Keys together with PostgreSQL while retaining the supported /var/www/wayfarer content root

Validation

• correction regressions: 3 passed
• complete focused provider/migration selection: 23 passed
• guarded PostgreSQL provider tests: 6 passed
• existing administrator/personal routing selection: 30 passed
• Release build: succeeded with 0 warnings and 0 errors
• EF pending-model check: none
• LOC policy and git diff --check: passed
• retained wider-suite evidence: 2,557 passed; one Playwright test remained unavailable because the installed Chromium revision did not match the expected revision (infrastructure evidence, not claimed green)

Screenshots

Not included. The settings changes are server-rendered, were reviewed at the Razor/controller seams, and mounted browser evidence remained unavailable due to the documented Playwright revision mismatch.

Closes #499