feat: Extract AES-GCM into shared/cryptobox

services/crypto.go keeps its function names and its KEY_ENCRYPTION_KEY
lookup and delegates the cipher, so vantagectl's verify probe can decrypt
with the same implementation rather than a second copy.

cryptobox/cryptobox.go

@@ -0,0 +1,67 @@
+// Package cryptobox is the AES-256-GCM primitive used for everything Vantage
+// encrypts at rest: SSH private keys, key passphrases, vault secrets, OIDC
+// client secrets and console credentials.
+//
+// It takes a raw key and reads no environment. Key sourcing belongs to the
+// caller, because the two callers source it differently: the server reads
+// KEY_ENCRYPTION_KEY at the point of use, while vantagectl is handed one.
+package cryptobox
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
+	"io"
+)
+
+// KeySize is the only key length accepted. AES-256 by construction.
+const KeySize = 32
+
+func gcmFor(key []byte) (cipher.AEAD, error) {
+	if len(key) != KeySize {
+		return nil, fmt.Errorf("key must be %d bytes, got %d", KeySize, len(key))
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	return cipher.NewGCM(block)
+}
+
+// Seal encrypts plaintext and returns nonce||ciphertext, hex encoded.
+func Seal(key []byte, plaintext string) (string, error) {
+	gcm, err := gcmFor(key)
+	if err != nil {
+		return "", err
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(gcm.Seal(nonce, nonce, []byte(plaintext), nil)), nil
+}
+
+// Open reverses Seal. Every failure mode returns an error that does not
+// distinguish a wrong key from corrupt data, because the caller cannot act on
+// the difference and an oracle is worth avoiding for free.
+func Open(key []byte, ciphertextHex string) (string, error) {
+	gcm, err := gcmFor(key)
+	if err != nil {
+		return "", err
+	}
+	data, err := hex.DecodeString(ciphertextHex)
+	if err != nil {
+		return "", fmt.Errorf("invalid ciphertext encoding")
+	}
+	n := gcm.NonceSize()
+	if len(data) < n {
+		return "", fmt.Errorf("ciphertext too short")
+	}
+	plaintext, err := gcm.Open(nil, data[:n], data[n:], nil)
+	if err != nil {
+		return "", fmt.Errorf("decryption failed")
+	}
+	return string(plaintext), nil
+}

cryptobox/cryptobox_test.go

@@ -0,0 +1,79 @@
+package cryptobox
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/hex"
+	"testing"
+)
+
+func testKey(t *testing.T) []byte {
+	t.Helper()
+	k := make([]byte, KeySize)
+	if _, err := rand.Read(k); err != nil {
+		t.Fatalf("rand: %v", err)
+	}
+	return k
+}
+
+func TestSealOpenRoundTrip(t *testing.T) {
+	key := testKey(t)
+	sealed, err := Seal(key, "hunter2")
+	if err != nil {
+		t.Fatalf("Seal: %v", err)
+	}
+	if _, err := hex.DecodeString(sealed); err != nil {
+		t.Fatalf("Seal output is not hex: %v", err)
+	}
+	if bytes.Contains([]byte(sealed), []byte("hunter2")) {
+		t.Fatal("plaintext appears in ciphertext")
+	}
+	got, err := Open(key, sealed)
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	if got != "hunter2" {
+		t.Fatalf("got %q, want %q", got, "hunter2")
+	}
+}
+
+func TestSealIsNonDeterministic(t *testing.T) {
+	key := testKey(t)
+	a, err := Seal(key, "same")
+	if err != nil {
+		t.Fatalf("Seal: %v", err)
+	}
+	b, err := Seal(key, "same")
+	if err != nil {
+		t.Fatalf("Seal: %v", err)
+	}
+	if a == b {
+		t.Fatal("two seals of the same plaintext are identical; nonce is not random")
+	}
+}
+
+func TestOpenWrongKeyFails(t *testing.T) {
+	sealed, err := Seal(testKey(t), "secret")
+	if err != nil {
+		t.Fatalf("Seal: %v", err)
+	}
+	if _, err := Open(testKey(t), sealed); err == nil {
+		t.Fatal("Open with the wrong key succeeded")
+	}
+}
+
+func TestOpenRejectsBadInput(t *testing.T) {
+	key := testKey(t)
+	if _, err := Open(key, "not-hex"); err == nil {
+		t.Fatal("Open accepted non-hex input")
+	}
+	if _, err := Open(key, "abcd"); err == nil {
+		t.Fatal("Open accepted a ciphertext shorter than the nonce")
+	}
+}
+
+func TestWrongKeySizeRejected(t *testing.T) {
+	if _, err := Seal(make([]byte, 16), "x"); err == nil {
+		t.Fatal("Seal accepted a 16-byte key")
+	}
+}