IP recovery sends encrypted miner credentials to plugins

🤖 Filed by an AI agent after reproducing this during manual IP scanner testing.

## Problem

The IP recovery identity check reads miner credentials from `miner_credentials`, but forwards the encrypted database values to the plugin as if they were plaintext username and password values. Authenticated drivers therefore reject the identity probe, so Fleet cannot verify and repair the address of an offline miner even when the saved credentials are correct.

This is separate from #792, which covers Antminer discovery returning incomplete identity data.

## Reproduction

1. Pair a Proto fake rig using valid credentials and verify it is `PAIRED` and `ACTIVE`.
2. Change its stored discovered IP to another address and mark it `OFFLINE`.
3. Restart Fleet so the IP scanner runs immediately.
4. Fleet discovers the rig at its real address, but `IsSameDevice` logs `authentication failed for paired device`, changes the target to `AUTHENTICATION_NEEDED`, and completes with `devices_found=0`.
5. Temporarily replace the encrypted credential columns with their plaintext values and rerun the scan. The same rig is verified by serial and MAC, and the stored address is corrected successfully.

## Root cause

`SQLDeviceStore.GetMinerCredentials` returns `username_enc` and `password_enc` directly in `pairing.v1.Credentials`. `pairing.Service.IsSameDevice` passes those values to `Pairer.GetDeviceInfo`, which builds a plugin secret bundle without decrypting them.

Relevant paths:

- `server/internal/domain/stores/sqlstores/device.go`
- `server/internal/domain/pairing/service.go`
- `server/internal/domain/plugins/pairer.go`

The affected code is unchanged by #782 and is present on `main`.

## Impact

Automatic IP recovery fails for drivers that authenticate while describing a rediscovered device. Valid paired credentials can also be incorrectly reported as stale by moving the miner to `AUTHENTICATION_NEEDED`.

## Expected behavior

Identity verification should provide decrypted credentials to the plugin while encrypted values remain confined to the persistence boundary. A failed probe against a different discovered miner should not invalidate the target credentials.

## Acceptance criteria

- Stored credentials are decrypted before the IP recovery identity probe reaches the plugin.
- A Proto fake rig with a deliberately stale stored IP is rediscovered and updated using normally encrypted stored credentials.
- Authentication failures during subnet probing do not incorrectly invalidate valid credentials for the target device.
- Regression coverage verifies the encrypted-storage-to-plaintext-plugin boundary.

Read server/internal/domain/stores/sqlstores/device.go, server/internal/domain/pairing/service.go, and server/internal/domain/plugins/pairer.go, then trace the IP recovery identity probe. Reproduce the stale-IP scenario with a Proto fake rig and normally encrypted stored credentials. Done means the rig is rediscovered and updated, valid credentials remain valid after failed subnet probes, and regression coverage verifies the credential boundary.

Written by the indexing model from the issue text.