vault: files sealed under a password that is never stored

Argon2id turns the vault password into a key that seals a random master
key; only the sealed copy is kept. Each file gets its own key, sealed
under the master key in its header with its media id, and its bytes are
AES-256-GCM STREAM records, so a swapped, cut or altered file refuses
to open. Uploads with ?encrypt=true are sealed as they stream in.

:vault, :unlock, :lock, :passwd, :encrypt, :decrypt and :upload! drive
it. The vault locks after WORKSPACE_VAULT_IDLE_MIN idle minutes, on
logout and on restart; while locked, sealed files answer 423, share
links never serve them, and :export! refuses rather than leave them out.

Sealing an existing file rewrites it under a new id and retires the old
one: the mirror deletes the plaintext from Proton Drive outright,
trash included, whatever WORKSPACE_BACKUP_PRUNE says, and drops it from
the readable files/ view. The mirror now compares on-disk sizes, so
sealed files are not re-hashed every run.

Cargo.toml

@@ -40,6 +40,14 @@ lettre = { version = "0.11", default-features = false, features = ["smtp-transpo
 chrono = { version = "0.4", default-features = false, features = ["clock", "std"] }
 chrono-tz = "0.10"
 
+# The vault: files encrypted at rest under a key only a password unlocks.
+# AES-256-GCM in the STREAM construction, so a file of any size is sealed and
+# opened a chunk at a time; Argon2id between the password and the key.
+aes-gcm = { version = "0.10", features = ["stream"] }
+argon2 = "0.5"
+zeroize = "1"
+futures-util = { version = "0.3", default-features = false, features = ["std"] }
+
 proton-drive-rs = "0.6.2"
 proton-sdk = "0.6.2"
 rpassword = "7"