backup: seal the Proton session under a key kept off the volume

WORKSPACE_SESSION_KEY_FILE names a file holding a 32-byte key, meant to
be a Docker secret. When it is set, proton-session.json is written as
AES-256-GCM ciphertext, so a copy of the data volume alone no longer
carries a usable session. That is what the OS keyring gives a native
host, for a container that has no Secret Service.

A plain session found while a key is set is sealed the first time it is
read. A sealed file without its key, or a malformed key file, is an
error at startup rather than a quiet fall back to plain JSON.

src/cli.rs

@@ -31,7 +31,7 @@ narl-workspace — a terminal-themed personal workspace
 ";
 
 pub async fn proton_login(config: &Config) -> Result<()> {
-    let store = backup::session::SessionStore::new(config.proton_session_path());
+    let store = backup::session::SessionStore::open(config)?;
 
     // Said before anything is asked for, not after: Proton requires a
     // third-party client to be honest about what it is at the point where
@@ -68,7 +68,7 @@ pub async fn proton_login(config: &Config) -> Result<()> {
 }
 
 pub fn proton_logout(config: &Config) -> Result<()> {
-    let store = backup::session::SessionStore::new(config.proton_session_path());
+    let store = backup::session::SessionStore::open(config)?;
     store.clear()?;
     println!("Forgot the Proton session. Backups are off until the next login.");
     println!(
@@ -78,7 +78,7 @@ pub fn proton_logout(config: &Config) -> Result<()> {
 }
 
 pub async fn proton_status(db: &SqlitePool, config: &Config) -> Result<()> {
-    let store = backup::session::SessionStore::new(config.proton_session_path());
+    let store = backup::session::SessionStore::open(config)?;
     let Some(stored) = store.load()? else {
         println!("Proton Drive backups are not configured.");
         println!("Run `narl-workspace proton-login` to enable them.");