Step 20: Encryption polish — e2e test, docs, flake.

E2e encryption test: full lifecycle covering init, add encrypted +
plaintext, checkpoint, modify, status (no DEK needed), re-checkpoint,
restore, verify, re-open with unlock, diff, slot management, passphrase
change, old passphrase rejection.

Docs updated:
- ARCHITECTURE.md: package structure (encrypt.go, encrypt_fido2.go,
  encrypt CLI), Garden struct (dek field, encryption methods), auth.go
  descriptions updated for JWT
- README.md: encryption commands table, encryption section with usage
- CLAUDE.md: added jwt/argon2/chacha20 deps, encryption file mentions

flake.nix: vendorHash updated for new deps.

Phase 3 complete.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

README.md

@@ -88,6 +88,17 @@ sgard restore --repo /mnt/usb/dotfiles
 | `mirror down <path> [-f]` | Sync manifest → filesystem (restore + delete untracked) |
 | `version` | Print the version |
 
+### Encryption
+
+| Command | Description |
+|---|---|
+| `encrypt init` | Set up encryption (creates DEK + passphrase slot) |
+| `encrypt add-fido2 [--label]` | Add a FIDO2 KEK slot |
+| `encrypt remove-slot <name>` | Remove a KEK slot |
+| `encrypt list-slots` | List all KEK slots |
+| `encrypt change-passphrase` | Change the passphrase |
+| `add --encrypt <path>...` | Track files with encryption |
+
 ### Remote sync
 
 | Command | Description |
@@ -121,6 +132,31 @@ sgard pull --remote myserver:9473
 Authentication uses your existing SSH keys (ssh-agent, `~/.ssh/id_ed25519`,
 or `--ssh-key`). No passwords or certificates to manage.
 
+## Encryption
+
+Sensitive files can be encrypted individually:
+
+```sh
+# Set up encryption (once per repo)
+sgard encrypt init
+
+# Add encrypted files
+sgard add --encrypt ~/.ssh/config ~/.aws/credentials
+
+# Plaintext files work as before
+sgard add ~/.bashrc
+```
+
+Encrypted blobs use XChaCha20-Poly1305. The data encryption key (DEK)
+is wrapped by a passphrase-derived key (Argon2id). FIDO2 hardware keys
+are also supported as an alternative KEK source — sgard tries FIDO2
+first and falls back to passphrase automatically.
+
+The encryption config (wrapped DEKs, salts) lives in the manifest, so
+it syncs with push/pull. The server never has the DEK.
+
+See [ARCHITECTURE.md](ARCHITECTURE.md) for the full encryption design.
+
 ## How it works
 
 sgard stores files in a content-addressable blob store keyed by SHA-256.