feat(auth): support per-deploy login password key override

Multi-replica deployments need every Pod/container to share one RSA private key, otherwise public keys handed to the browser may not match the key that decrypts the resulting ciphertext. Introduce a `*.local.yaml` override layer that ops-config and tenant-config both load on top of the base config, ship example overrides plus compose/k3s wiring, and tolerate PEM bodies that arrive folded or escaped from Secrets.

server/internal/shared/auth/password_cipher_test.go

@@ -7,6 +7,7 @@ import (
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/pem"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -62,3 +63,53 @@ func TestNewEphemeralPasswordCipherExposesPublicKey(t *testing.T) {
 	require.Equal(t, "RSA-OAEP-256", publicKey.Algorithm)
 	require.Contains(t, publicKey.PublicKey, "BEGIN PUBLIC KEY")
 }
+
+func TestPasswordCipherAcceptsFoldedPrivateKeyPEM(t *testing.T) {
+	t.Parallel()
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	privatePEM := string(pem.EncodeToMemory(&pem.Block{
+		Type:  "PRIVATE KEY",
+		Bytes: mustMarshalPKCS8PrivateKey(t, key),
+	}))
+	foldedPEM := strings.Join(strings.Fields(privatePEM), " ")
+
+	_, err = NewPasswordCipher(foldedPEM, "folded")
+	require.NoError(t, err)
+}
+
+func TestPasswordCipherAcceptsEscapedNewlinePrivateKeyPEM(t *testing.T) {
+	t.Parallel()
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	privatePEM := string(pem.EncodeToMemory(&pem.Block{
+		Type:  "PRIVATE KEY",
+		Bytes: mustMarshalPKCS8PrivateKey(t, key),
+	}))
+	escapedPEM := strings.ReplaceAll(strings.TrimSpace(privatePEM), "\n", `\n`)
+
+	_, err = NewPasswordCipher(escapedPEM, "escaped")
+	require.NoError(t, err)
+}
+
+func TestNormalizePrivateKeyPEMPreservesValidPEM(t *testing.T) {
+	t.Parallel()
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	privatePEM := string(pem.EncodeToMemory(&pem.Block{
+		Type:  "PRIVATE KEY",
+		Bytes: mustMarshalPKCS8PrivateKey(t, key),
+	}))
+
+	require.Equal(t, strings.TrimSpace(privatePEM), strings.TrimSpace(normalizePrivateKeyPEM(privatePEM)))
+}
+
+func mustMarshalPKCS8PrivateKey(t *testing.T, key *rsa.PrivateKey) []byte {
+	t.Helper()
+	der, err := x509.MarshalPKCS8PrivateKey(key)
+	require.NoError(t, err)
+	return der
+}