bug: Connections (API keys) become permanently invalid after every `cptr run` restart due to JWT secret regeneration

Description

Every time cptr run is restarted, all previously configured Connections (including their encrypted API keys) become permanently unusable. Attempting to view, edit, verify, or even delete the affected connections triggers a 500 Internal Server Error, and the model list becomes empty ("沒有可用模型" / "No available models").

Steps to Reproduce

1. Run cptr run and complete initial setup.
2. Go to Settings → Connections, add a new connection (e.g. Ollama, http://<host>:11434), fill in API key, verify successfully, save.
3. Confirm the model list populates correctly and the connection works as expected.
4. Stop the process (Ctrl+C) and run cptr run again.
5. Open the same workspace. The model list is now empty.
6. Open the previously working connection under Settings → Connections and click "Verify" or just reload the Connections page.

Expected Behavior

Connections and their encrypted credentials should persist across restarts, as long as the workspace directory (and its .cptr/ folder) has not been deleted.

Actual Behavior

• Model dropdown shows "No available models".
• Opening the connections list triggers backend errors.
• Server-side log shows:

Start at the cptr run entry point and inspect how the JWT secret and workspace .cptr/ state are initialized across restarts. Reproduce the connection failure after restarting, then verify that existing connections, encrypted API keys, and the model list remain usable without deleting the workspace.