Replace plain TemplateStore with SecureTemplateStore in the auth service. Templates are now encrypted with AES-256-GCM via TPM2 when available, falling back to software encryption with PBKDF2 key derivation (600k iterations) otherwise. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>