Support protected encryption contexts

[kwent]

Summary

• respect ActiveRecord::Encryption.protecting_encrypted_data for Lockbox-encrypted attributes and direct decryptions
• return stored ciphertext before cached plaintext or type casting can expose data
• prevent encrypted model attributes from being modified while the protected context is active
• document the resulting no-decryption-by-default console1984 integration

Why

console1984 already runs protected console commands inside Active Record's protected encryption context. Lockbox did not observe that context, so its attributes were still decrypted automatically. Using the existing Rails context keeps the integration decoupled and requires no console1984-specific runtime dependency.

Closes #181.
Related to #208.

Validation

• bundle exec ruby -Itest test/model_test.rb
• bundle exec ruby -Itest test/lockbox_test.rb
• Ruby 4.0 / current Rails: bundle exec rake test (272 runs, 1006 assertions, 0 failures, 0 errors)
• Ruby 3.4 / Rails 8.0: BUNDLE_GEMFILE=gemfiles/rails80.gemfile bundle exec rake test (272 runs, 1006 assertions, 0 failures, 0 errors)
• Ruby 3.3 / Rails 7.2: BUNDLE_GEMFILE=gemfiles/rails72.gemfile bundle exec rake test (272 runs, 1006 assertions, 0 failures, 0 errors)