v0.9.1 encrypt database and bug fixes

backend/src/models/db.js

@@ -1,9 +1,10 @@
-const Database = require('better-sqlite3');
+const Database = require('better-sqlite3-sqlcipher');
 const path = require('path');
 const fs = require('fs');
 const bcrypt = require('bcryptjs');
 
 const DB_PATH = process.env.DB_PATH || '/app/data/jama.db';
+const DB_KEY  = process.env.DB_KEY  || '';
 
 let db;
 
@@ -16,6 +17,13 @@ function getDb() {
       console.log(`[DB] Created data directory: ${dir}`);
     }
     db = new Database(DB_PATH);
+    if (DB_KEY) {
+      // Apply encryption key — must be the very first pragma before any other DB access
+      db.pragma(`key = '${DB_KEY.replace(/'/g, "''")}'`);
+      console.log('[DB] Encryption key applied');
+    } else {
+      console.warn('[DB] WARNING: DB_KEY not set — database is unencrypted');
+    }
     db.pragma('journal_mode = WAL');
     db.pragma('foreign_keys = ON');
     console.log(`[DB] Opened database at ${DB_PATH}`);