Summary

• C1 (Critical): Replaces AES-CFB (no integrity) with AES-GCM (authenticated encryption), preventing bit-flip attacks on encrypted session tokens
• H3 (High): Replaces null-byte key padding with HKDF-SHA256 key derivation, ensuring proper 32-byte key regardless of input length
• Removes commented-out hardcoded encryption key (L3)

Changes

• internal/crypto/aes.go: Complete rewrite of EncryptAES/DecryptAES using AES-256-GCM + HKDF
• internal/crypto/aes_test.go: New test suite covering roundtrip, tamper detection, wrong key, short/long keys

Security Impact

• Tampered ciphertexts are now detected and rejected (GCM authentication tag)
• Key derivation uses HKDF-SHA256 instead of null-byte padding, maximizing entropy
• Function signatures unchanged — drop-in replacement

Test plan

• All 7 new AES tests pass
• Verify session token encrypt/decrypt works end-to-end
• Verify existing sessions will need re-login (expected — new encryption format)