NAS GUI upgrades that drop container environment variables could leave login working while AI and object-storage credentials could no longer be encrypted. Persist the encryption root on /data, generate one when an existing instance has no secret, and stop the add-service form from looking fillable when encryption is still unavailable. Fixes #370