feat(kafka): support TLS and SASL authentication for external Kafka brokers

Problem

When KAFKA_BROKERS is configured, OpenPanel creates its KafkaJS client without passing ssl or sasl options. This prevents connections to common managed or secured Kafka deployments that require TLS and SASL authentication.

Affected code

packages/queue/src/kafka.ts, in getKafka().

Expected behavior

Preserve the current unauthenticated connection behavior when no security-related environment variables are configured. When configured, support these common modes:

• TLS only
• SASL/PLAIN over TLS
• SASL/SCRAM-SHA-256 over TLS
• SASL/SCRAM-SHA-512 over TLS

Suggested configuration

KAFKA_SASL_USERNAME=...
KAFKA_SASL_PASSWORD=...
KAFKA_SASL_MECHANISM=scram-sha-512

Suggested behavior:

• If neither username nor password is configured, preserve the existing behavior.
• If only one is configured, fail fast with a clear configuration error.
• Default the mechanism to scram-sha-512 when SASL credentials are present.
• Reject unsupported mechanisms before creating the Kafka client.
• Do not log credential values.

Why this matters

TLS/SASL is a common requirement for managed Kafka and production Kafka installations. Supporting it through environment configuration would make the Kafka integration usable without requiring source changes or a custom image.

Start in packages/queue/src/kafka.ts at getKafka(), and inspect how KAFKA_BROKERS and related environment variables are currently read. Implement the four requested TLS/SASL modes while preserving unauthenticated connections, validating incomplete credentials and unsupported mechanisms before client creation, and ensuring credentials are not logged.