feat(lazy-reencryption): Phase 2-4 — Core logic, password change, integration tests

[Erik-Castro]

Summary

PR #2 of feature-branch-chain feat/lazy-reencryption. Core implementation of lazy KEK re-encryption:

Core Logic:

• Rewrote kek_rotate() → O(1): archive current KEK → generate new → atomic version increment — no per-secret work
• Lazy-migrate in ssm_secret_get(): detects stale kek_version, looks up archived KEK, decrypts, re-encrypts with current KEK, updates row atomically
• Safe-purge: after lazy-migrate, COUNT checks if any secrets still reference old version; if zero, deletes archive entry

Password Change:

• ssm_user_change_password() extended to re-wrap all archived KEK entries with new auth_hash

Public API:

• ssm_kek_purge_archive(h, username) — manually purge fully-migrated archive entries

Tests:

• 15 new tests covering O(1) rotation, lazy-migrate, safe-purge, password change, concurrency (10 threads)

Type of Change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change
• Documentation / meta

SDD Checklist

• secure_erase / secure_buffer used for all sensitive data
• No hardcoded secrets, keys, or passwords added
• Error paths do not leak sensitive information in messages
• Thread safety: unique_lock in ssm_secret_get covers both decrypt and lazy-migrate
• Memory: no raw delete/free without RAII wrapper
• Input validation: all public API parameters checked

Testing Checklist

• New tests added: 15 tests (rotation, lazy-migrate, purge, password change, concurrency)
• Existing tests: build environment unavailable (Termux NDK incompatibility)
• Build: environment unavailable
• Code formatted: verified manually
• Memory: N/A — no new memory management patterns

Related Issues

Part of SDD change lazy-reencryption. PR #1 (#9) is the foundation.