## ADDED Requirements

### Requirement: Credentials are stored encrypted
The system SHALL store access tokens and SSH keys encrypted at rest.

#### Scenario: Store access token
- **WHEN** a user saves an access token
- **THEN** the system encrypts it with Fernet
- **AND** stores the encrypted value in the database

#### Scenario: Retrieve access token
- **WHEN** the system retrieves a credential for API calls
- **THEN** it decrypts the value
- **AND** returns the plaintext token

#### Scenario: List credentials without exposing values
- **WHEN** a user lists their credentials
- **THEN** the system returns metadata (name, provider, created_at)
- **AND** masks the token value (showing only last 4 characters)

### Requirement: Credential storage supports multiple providers
The system SHALL support storing credentials for different Git providers.

#### Scenario: Store GitHub token
- **WHEN** a user adds a GitHub personal access token
- **THEN** the system stores it with provider_type="github"

#### Scenario: Store GitLab token
- **WHEN** a user adds a GitLab personal access token
- **THEN** the system stores it with provider_type="gitlab"