Add MEK rotation, per-engine DEKs, and v2 ciphertext format (audit #6, #22)

Implement a two-level key hierarchy: the MEK now wraps per-engine DEKs
stored in a new barrier_keys table, rather than encrypting all barrier
entries directly. A v2 ciphertext format (0x02) embeds the key ID so the
barrier can resolve which DEK to use on decryption. v1 ciphertext remains
supported for backward compatibility.

Key changes:
- crypto: EncryptV2/DecryptV2/ExtractKeyID for v2 ciphertext with key IDs
- barrier: key registry (CreateKey, RotateKey, ListKeys, MigrateToV2, ReWrapKeys)
- seal: RotateMEK re-wraps DEKs without re-encrypting data
- engine: Mount auto-creates per-engine DEK
- REST + gRPC: barrier/keys, barrier/rotate-mek, barrier/rotate-key, barrier/migrate
- proto: BarrierService (v1 + v2) with ListKeys, RotateMEK, RotateKey, Migrate
- db: migration v2 adds barrier_keys table

Also includes: security audit report, CSRF protection, engine design specs
(sshca, transit, user), path-bound AAD migration tool, policy engine
enhancements, and ARCHITECTURE.md updates.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

proto/metacrypt/v1/barrier.proto

@@ -0,0 +1,43 @@
+syntax = "proto3";
+
+package metacrypt.v1;
+
+option go_package = "git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1";
+
+service BarrierService {
+  rpc ListKeys(ListKeysRequest) returns (ListKeysResponse);
+  rpc RotateMEK(RotateMEKRequest) returns (RotateMEKResponse);
+  rpc RotateKey(RotateKeyRequest) returns (RotateKeyResponse);
+  rpc Migrate(MigrateBarrierRequest) returns (MigrateBarrierResponse);
+}
+
+message ListKeysRequest {}
+message ListKeysResponse {
+  repeated BarrierKeyInfo keys = 1;
+}
+
+message BarrierKeyInfo {
+  string key_id = 1;
+  int32 version = 2;
+  string created_at = 3;
+  string rotated_at = 4;
+}
+
+message RotateMEKRequest {
+  string password = 1;
+}
+message RotateMEKResponse {
+  bool ok = 1;
+}
+
+message RotateKeyRequest {
+  string key_id = 1;
+}
+message RotateKeyResponse {
+  bool ok = 1;
+}
+
+message MigrateBarrierRequest {}
+message MigrateBarrierResponse {
+  int32 migrated = 1;
+}

proto/metacrypt/v2/barrier.proto

@@ -0,0 +1,43 @@
+syntax = "proto3";
+
+package metacrypt.v2;
+
+option go_package = "git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v2;metacryptv2";
+
+service BarrierService {
+  rpc ListKeys(ListKeysRequest) returns (ListKeysResponse);
+  rpc RotateMEK(RotateMEKRequest) returns (RotateMEKResponse);
+  rpc RotateKey(RotateKeyRequest) returns (RotateKeyResponse);
+  rpc Migrate(MigrateBarrierRequest) returns (MigrateBarrierResponse);
+}
+
+message ListKeysRequest {}
+message ListKeysResponse {
+  repeated BarrierKeyInfo keys = 1;
+}
+
+message BarrierKeyInfo {
+  string key_id = 1;
+  int32 version = 2;
+  string created_at = 3;
+  string rotated_at = 4;
+}
+
+message RotateMEKRequest {
+  string password = 1;
+}
+message RotateMEKResponse {
+  bool ok = 1;
+}
+
+message RotateKeyRequest {
+  string key_id = 1;
+}
+message RotateKeyResponse {
+  bool ok = 1;
+}
+
+message MigrateBarrierRequest {}
+message MigrateBarrierResponse {
+  int32 migrated = 1;
+}