feat(nodes): opt-in encryption at rest for the outbound node API token (#6186)

* node: encrypt outbound bearer token at rest

* fix(nodes): keep bearer tokens encrypted throughout

---------

Co-authored-by: n0ctal <293235942+n0ctal@users.noreply.github.com>

main_test.go

@@ -0,0 +1,12 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestCommandHelpListsEncryptTokens(t *testing.T) {
+	if help := commandHelp(); !strings.Contains(help, "encrypt-tokens") {
+		t.Fatalf("command help omits encrypt-tokens:\n%s", help)
+	}
+}