feat(snapshots): add reveal option to snapshot GET endpoint for env var inspection

[dennisonbertram]

Problem

Snapshots Story 3 (Get Snapshot Details) notes in Security: "Env vars NOT returned in Get operation (only decrypted on service creation)." This means there is no way to inspect what env vars are stored in a snapshot before using it to create a service. Users cannot verify snapshot contents without creating a service from it.

Expected Behavior

• GET /v1/snapshots/{snapshotID}?reveal=true should decrypt and return the snapshot's env vars (keys + values)
• GET /v1/snapshots/{snapshotID} (without reveal) should return env var keys only (masked values)
• This parallels the existing env var reveal pattern on services

Context

Discovered via UX Paths analysis (docs/ux-paths/topics/snapshots.md — Story 3, Security section)

[dennisonbertram]

Needs clarification: What specific fields should be revealed when reveal=true? Should it show all env vars in plain text, or just the values (currently they're AES-256-GCM encrypted)? Should this require any additional auth beyond the standard API key?

[dennisonbertram]

PR created: #141