Release 2.5.0: keyring ciphertext format with key IDs, field binding and padding; BlindIndex

[yuriizee]

Added (opt-in)

• EncryptedCast(keyring: AppKeyring::class) with the EncryptionKeyring contract writes v2:<key id>:… (XChaCha20-Poly1305-IETF):
  • key ID in every value — rotation without downtime (S1-02);
  • class + field (or context:) authenticated as associated data — a ciphertext moved to another field is rejected (S1-03);
  • plaintext padded to 32-byte blocks (S1-14);
  • keys must be 32 random bytes, raw or base64; subkey via sodium_crypto_kdf_derive_from_key (S1-01).
• With a legacy key next to the keyring, both formats are read and only the new one is written. Without keyring: nothing changes.
• needsReencryption() / forField() for migration scripts.
• Support\BlindIndex — keyed HMAC-SHA256 for searching encrypted columns (S1-16).
• Contracts\BindsToField — casts learn their class and field at metadata build time.

Verification

• Docker: 817 tests, 100% line coverage (2101/2101).
• Benchmarks: hydration/serialization within noise; legacy EncryptedCast::get() 804 → 816 ns, set() unchanged.