[Future] Encryption key rotation with envelope encryption

[Raulgooo]

Future

Objective

Envelope encryption with key rotation.

Problem

• Single derived key
• Changing secret bricks vault data

Fix

1. Master key → DEKs
2. DEK IDs with encrypted data
3. Rotate DEKs without re-encryption
4. Master key in env only

Files

• internal/vault/vault.go
• internal/crypto/

Acceptance Criteria

• Envelope encryption
• DEK rotation
• No data loss on key change
• Master key never in DB