Initial scaffold: FastAPI backend + Vue 3 frontend + Docker setup

Backend: config/db/security/logging core, SQLAlchemy models (Server,
Credential, UpdateJob, UpdateLog, AuditLog, User), services (winrm, ssh,
cau, audit, job_runner), REST API (auth, servers, updates, audit),
Socket.io WebSocket layer.
Frontend: Vue 3 + TS + Pinia + Tailwind, Views (Dashboard, Servers,
Updates, Audit, Login), axios + socket.io-client, nginx prod config.

backend/app/models/credential.py

@@ -0,0 +1,39 @@
+"""Credential model - secrets stored Fernet-encrypted."""
+
+from datetime import UTC, datetime
+
+from sqlalchemy import DateTime, Enum, String, Text
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.core.database import Base
+
+import enum
+
+
+class CredentialType(str, enum.Enum):
+    WINRM_USERPASS = "winrm_userpass"
+    SSH_USERPASS = "ssh_userpass"
+    SSH_KEY = "ssh_key"
+
+
+class Credential(Base):
+    __tablename__ = "credentials"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    name: Mapped[str] = mapped_column(String(255), unique=True)
+    type: Mapped[CredentialType] = mapped_column(Enum(CredentialType))
+
+    username: Mapped[str] = mapped_column(String(255))
+    # Encrypted at rest via core.security.encrypt()
+    password_encrypted: Mapped[str | None] = mapped_column(Text, nullable=True)
+    private_key_encrypted: Mapped[str | None] = mapped_column(Text, nullable=True)
+    key_passphrase_encrypted: Mapped[str | None] = mapped_column(Text, nullable=True)
+
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), default=lambda: datetime.now(UTC)
+    )
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True),
+        default=lambda: datetime.now(UTC),
+        onupdate=lambda: datetime.now(UTC),
+    )