BYOK: per-record PBKDF2 salt for at-rest key derivation (defense-in-depth)

[JSONbored]

Part of #525. From the BYOK security audit.

deriveSecretAesKey (src/utils/crypto.ts) uses a single static salt for all keys. Acceptable today (single high-entropy TOKEN_ENCRYPTION_SECRET; per-record random IV already guarantees ciphertext uniqueness) — defense-in-depth only.

Fix (optional): generate a random salt per encryption, store it alongside iv/keyVersion, pass to deriveSecretAesKey on decrypt; gate behind keyVersion so existing v1 rows keep the constant salt. Requires a migration (new column).

Severity: low (audit rated acceptable; deferred unless rotation/KDF change is needed).

[JSONbored]

Resolved in #680 — per-record PBKDF2 salt (envelope v2) with v1 backward-compat; migration 0030 adds the nullable salt column.