🔑 AES Encryption

Implementation: PBKDF2 (100 000 iter, SHA-256) → AES-256-GCM (128-bit IV). The encrypted output bundles [salt || iv || ciphertext] and is Base64-encoded.