feat(crypto): add password-based encryption (PasswordCipher)

[tgiachi]

Summary

A static password-based encryption primitive in SquidStd.Crypto: PasswordCipher encrypts a payload under a password (Argon2id derives the key, AES-256-GCM seals it) and produces a self-describing, versioned, AAD-bound envelope — decryption needs only the password and the blob. Fills the gap between CryptoUtils (raw key) and ISecretProtector (app-key/KMS).

API

byte[] blob = PasswordCipher.Encrypt(data, "password");           // PbkdfCost.Moderate by default
byte[] back = PasswordCipher.Decrypt(blob, "password");
string s    = PasswordCipher.EncryptString("secret", "pw");        // base64 envelope
string clr  = PasswordCipher.DecryptString(s, "pw");
PasswordCipher.Encrypt(data, "pw", PbkdfCost.Sensitive);          // tune Argon2 cost

Wrong password or tampered data → PasswordDecryptionException.

Architecture

• Pure format layer (PasswordEnvelope + PasswordEnvelopeCodec) — Terminal.Gui-free, unit-tested as plain data.
• Argon2id derivation (PasswordKeyDerivation, BouncyCastle) — same params/version as the existing vault.
• Orchestrator (PasswordCipher) — AES-256-GCM, random salt+nonce per call.
• PbkdfCost presets (Interactive / Moderate / Sensitive) + custom.

Envelope SPBE v1

magic(4) | version(1) | iterations(4) | memoryKib(4) | parallelism(1) | salt(16) | nonce(12) | tag(16) | ciphertext
The 42 bytes before the tag are the GCM AAD, so version (no downgrade), KDF cost, salt and nonce are all authenticated.

Security notes

• Salt (16) and nonce (12) are freshly random per Encrypt — no nonce reuse under a fixed key (the key also varies by salt).
• The wrapped exception is generic (doesn't reveal wrong-password vs corruption); no AEAD padding oracle.
• PbkdfCost rejects parallelism > 255 (the envelope byte field) to avoid silent truncation.

Test plan

• Solution builds (0 errors)
• Full suite green — 940 tests, 0 failures (23 new PBE tests: PbkdfCost 7, EnvelopeCodec 5, KeyDerivation 2, PasswordCipher 9)
• Round-trip (bytes, string, empty plaintext, non-ASCII password), wrong-password, tampered-ciphertext, tampered-header(AAD), per-call randomness, cost presets