feat: store layer with indexes, optimistic concurrency, GridFS, credential crypto (phase 2)

- mongo-driver v2 connection with bounded startup retry + /readyz gate
- idempotent creation of all §4.9 indexes
- UpdateVersioned: version-filtered updates, conflict vs not-found errors
- AES-256-GCM Seal/Open for ticketing credentials, base64(nonce|ct)
- GridFS file store: MIME sniffing, MAX_UPLOAD_MB cap, sha256 metadata
- HMAC-signed short-lived file URL tokens (§5.1, 1h TTL)
- integration tests against compose Mongo via docker-compose.test.yml overlay

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/crypto/crypto.go

@@ -0,0 +1,64 @@
+// Package crypto provides AES-256-GCM sealing for customer ticketing
+// credentials stored in Mongo (§4.2): ciphertext format base64(nonce|sealed).
+package crypto
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+)
+
+const keyLen = 32
+
+// Seal encrypts plaintext with AES-256-GCM and returns
+// base64(nonce|ciphertext) for storage.
+func Seal(key, plaintext []byte) (string, error) {
+	gcm, err := newGCM(key)
+	if err != nil {
+		return "", err
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := rand.Read(nonce); err != nil {
+		return "", fmt.Errorf("nonce: %w", err)
+	}
+	sealed := gcm.Seal(nonce, nonce, plaintext, nil)
+	return base64.StdEncoding.EncodeToString(sealed), nil
+}
+
+// Open decrypts a value produced by Seal.
+func Open(key []byte, encoded string) ([]byte, error) {
+	gcm, err := newGCM(key)
+	if err != nil {
+		return nil, err
+	}
+	raw, err := base64.StdEncoding.DecodeString(encoded)
+	if err != nil {
+		return nil, fmt.Errorf("decode ciphertext: %w", err)
+	}
+	if len(raw) < gcm.NonceSize() {
+		return nil, errors.New("ciphertext shorter than nonce")
+	}
+	plaintext, err := gcm.Open(nil, raw[:gcm.NonceSize()], raw[gcm.NonceSize():], nil)
+	if err != nil {
+		return nil, fmt.Errorf("decrypt: %w", err)
+	}
+	return plaintext, nil
+}
+
+func newGCM(key []byte) (cipher.AEAD, error) {
+	if len(key) != keyLen {
+		return nil, fmt.Errorf("key must be %d bytes, got %d", keyLen, len(key))
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, fmt.Errorf("aes: %w", err)
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, fmt.Errorf("gcm: %w", err)
+	}
+	return gcm, nil
+}

internal/crypto/crypto_test.go

@@ -0,0 +1,86 @@
+package crypto
+
+import (
+	"bytes"
+	"crypto/rand"
+	"strings"
+	"testing"
+)
+
+func testKey(t *testing.T) []byte {
+	t.Helper()
+	key := make([]byte, 32)
+	if _, err := rand.Read(key); err != nil {
+		t.Fatal(err)
+	}
+	return key
+}
+
+func TestSealOpenRoundTrip(t *testing.T) {
+	key := testKey(t)
+	tests := [][]byte{
+		[]byte(`{"email":"a@b.c","apiToken":"secret-token"}`),
+		[]byte(""),
+		[]byte(strings.Repeat("x", 100000)),
+		{0x00, 0xFF, 0x10},
+	}
+	for _, plaintext := range tests {
+		sealed, err := Seal(key, plaintext)
+		if err != nil {
+			t.Fatalf("Seal: %v", err)
+		}
+		got, err := Open(key, sealed)
+		if err != nil {
+			t.Fatalf("Open: %v", err)
+		}
+		if !bytes.Equal(got, plaintext) {
+			t.Errorf("round trip mismatch for %d-byte input", len(plaintext))
+		}
+	}
+}
+
+func TestSealIsNonDeterministic(t *testing.T) {
+	key := testKey(t)
+	a, _ := Seal(key, []byte("same"))
+	b, _ := Seal(key, []byte("same"))
+	if a == b {
+		t.Fatal("two seals of the same plaintext must differ (random nonce)")
+	}
+}
+
+func TestOpenRejectsTampering(t *testing.T) {
+	key := testKey(t)
+	sealed, err := Seal(key, []byte("credentials"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := Open(testKey(t), sealed); err == nil {
+		t.Error("wrong key must fail")
+	}
+	if _, err := Open(key, "!!not-base64!!"); err == nil {
+		t.Error("invalid base64 must fail")
+	}
+	if _, err := Open(key, "AAAA"); err == nil {
+		t.Error("too-short ciphertext must fail")
+	}
+	corrupted := []byte(sealed)
+	mid := len(corrupted) / 2
+	if corrupted[mid] == 'A' {
+		corrupted[mid] = 'B'
+	} else {
+		corrupted[mid] = 'A'
+	}
+	if _, err := Open(key, string(corrupted)); err == nil {
+		t.Error("corrupted ciphertext must fail authentication")
+	}
+}
+
+func TestKeyLengthEnforced(t *testing.T) {
+	if _, err := Seal(make([]byte, 16), []byte("x")); err == nil {
+		t.Error("16-byte key must be rejected")
+	}
+	if _, err := Open(make([]byte, 31), "AAAA"); err == nil {
+		t.Error("31-byte key must be rejected")
+	}
+}