feat(schema): encrypted columns — server-blind account-private fields (#133)

* feat(schema): encrypted columns — server-blind account-private fields

s.encryptedText(label) and s.encryptedJson<T>(label) seal field values
on the client before they enter Jazz, so the sync store holds versioned
ciphertext it cannot read: content becomes invisible to the store
operator while structure (tables, rows, writers, timestamps, sizes)
remains, and the engine syncs the column as an ordinary string.

The engine applies column transforms synchronously, so the cipher is
the audited @noble XChaCha20-Poly1305 rather than WebCrypto. Per-column
subkeys derive via HKDF over the column label, which is also bound as
associated data — ciphertext replayed into another column refuses to
open. The runtime derives the master key from the account secret and
installs it before creating the database client; touching an encrypted
column earlier fails closed, so a missing key can never cause a
plaintext write. Reading under a foreign account key throws
EncryptedColumnError instead of returning garbage.

Conformance (real engine): round-trip on insert/read/update, a where on
the plaintext matches nothing — the store never held it — and a foreign
key refuses. Unit: fail-closed paths, label domain separation, tamper,
truncation, randomized sealing, stored-shape assertions.

Part of #126 (Part 1); no upstream dependency.

* chore: lock the noble cipher dependencies

* docs: keep author-facing docs free of issue references

* docs: drop the issue reference from the encrypted-columns section

commit

f2100b360c4d26c82da3ddd61003a8e755f85b87

parent

1377b7771290d7dc338eca8a750aa9a61ac823cb

author

FelineStateMachine <dami.etoile@gmail.com>