backup: seal the Proton session under a key kept off the volume

WORKSPACE_SESSION_KEY_FILE names a file holding a 32-byte key, meant to
be a Docker secret. When it is set, proton-session.json is written as
AES-256-GCM ciphertext, so a copy of the data volume alone no longer
carries a usable session. That is what the OS keyring gives a native
host, for a container that has no Secret Service.

A plain session found while a key is set is sealed the first time it is
read. A sealed file without its key, or a malformed key file, is an
error at startup rather than a quiet fall back to plain JSON.

src/config.rs

@@ -145,6 +145,10 @@ pub struct BackupConfig {
     /// Whether a file deleted here is trashed there. Off by default: a backup
     /// that forgets on command is one accident away from being no backup.
     pub prune: bool,
+    /// A file holding the key `proton-session.json` is sealed under, kept off
+    /// the data volume (a Docker secret, say) so a copy of the volume alone
+    /// does not carry a usable session. `None` leaves the file as plain JSON.
+    pub session_key_file: Option<PathBuf>,
 }
 
 /// Look a setting up in the environment.
@@ -331,6 +335,7 @@ impl BackupConfig {
             interval,
             debounce,
             prune,
+            session_key_file: var("SESSION_KEY_FILE").map(PathBuf::from),
         })
     }
 }