cli: avoid data-dir initialization for version; create db parent dirs; redact generated passwords in CLI output

- Prevent 'nx9-wg version' from creating data directories by avoiding database initialization.
- Create parent directories when an explicit --database path is provided.
- Redact printed generated administrator passwords; announce file path or redact instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

crates/nx9-wg-db/src/settings.rs

@@ -0,0 +1,101 @@
+//! Settings repository operations.
+
+use crate::error::{DbError, Result};
+use crate::models::{format_datetime, parse_datetime};
+use chrono::Utc;
+use nx9_wg_core::types::settings::Setting;
+use sqlx::{Row, SqlitePool};
+
+/// Retrieve a setting by its key.
+pub async fn get_setting(pool: &SqlitePool, key: &str) -> Result<Option<Setting>> {
+    let row = sqlx::query("SELECT key, value, is_secret, updated_at FROM settings WHERE key = ?")
+        .bind(key)
+        .fetch_optional(pool)
+        .await
+        .map_err(DbError::Sqlx)?;
+
+    match row {
+        Some(r) => {
+            let key: String = r.try_get("key")?;
+            let value: String = r.try_get("value")?;
+            let is_secret_i64: i64 = r.try_get("is_secret")?;
+            let updated_at_str: String = r.try_get("updated_at")?;
+
+            Ok(Some(Setting {
+                key,
+                value,
+                is_secret: is_secret_i64 != 0,
+                updated_at: parse_datetime(&updated_at_str)?,
+            }))
+        }
+        None => Ok(None),
+    }
+}
+
+/// Retrieve only the string value of a setting, if present.
+pub async fn get_setting_value(pool: &SqlitePool, key: &str) -> Result<Option<String>> {
+    let setting = get_setting(pool, key).await?;
+    Ok(setting.map(|s| s.value))
+}
+
+/// Upsert a setting key-value pair.
+pub async fn set_setting(pool: &SqlitePool, key: &str, value: &str, is_secret: bool) -> Result<()> {
+    let now = Utc::now().naive_utc();
+    let now_str = format_datetime(&now);
+
+    sqlx::query(
+        r#"
+        INSERT INTO settings (key, value, is_secret, updated_at)
+        VALUES (?, ?, ?, ?)
+        ON CONFLICT(key) DO UPDATE SET
+            value = excluded.value,
+            is_secret = excluded.is_secret,
+            updated_at = excluded.updated_at
+        "#,
+    )
+    .bind(key)
+    .bind(value)
+    .bind(if is_secret { 1 } else { 0 })
+    .bind(&now_str)
+    .execute(pool)
+    .await
+    .map_err(DbError::Sqlx)?;
+
+    Ok(())
+}
+
+/// Delete a setting by key.
+pub async fn delete_setting(pool: &SqlitePool, key: &str) -> Result<()> {
+    sqlx::query("DELETE FROM settings WHERE key = ?")
+        .bind(key)
+        .execute(pool)
+        .await
+        .map_err(DbError::Sqlx)?;
+    Ok(())
+}
+
+/// List all settings.
+pub async fn list_settings(pool: &SqlitePool) -> Result<Vec<Setting>> {
+    let rows =
+        sqlx::query("SELECT key, value, is_secret, updated_at FROM settings ORDER BY key ASC")
+            .fetch_all(pool)
+            .await
+            .map_err(DbError::Sqlx)?;
+
+    let mut list = Vec::with_capacity(rows.len());
+    for r in rows {
+        let key: String = r.try_get("key")?;
+        let value: String = r.try_get("value")?;
+        let is_secret_i64: i64 = r.try_get("is_secret")?;
+        let updated_at_str: String = r.try_get("updated_at")?;
+
+        list.push(Setting {
+            key,
+            value,
+            is_secret: is_secret_i64 != 0,
+            updated_at: parse_datetime(&updated_at_str)?,
+        });
+    }
+
+    Ok(list)
+}