refactor(server): introduce CryptoService, replace MasterKey DI

[martsokha]

Replaces the MasterKey DI service + free crypto functions with a single CryptoService that handlers use directly.

Before

State(master_key): State<MasterKey>,
// ...
let workspace_key = master_key.derive_workspace_key(workspace_id);
let encrypted = encrypt_json(&workspace_key, &data)
    .map_err(|e: CryptoError| ErrorKind::InternalServerError.with_message(...).with_context(...))?;

After

State(crypto): State<CryptoService>,
// ...
let encrypted = crypto.encrypt_json(workspace_id, &data)?;

Changes

• CryptoService owns the master key (loaded from the key file, absorbing MasterKey's loading logic) and exposes workspace-scoped encrypt/decrypt/encrypt_json/decrypt_json (deriving the per-workspace key internally) plus master-scoped variants. Clone for DI.
• The cipher functions and EncryptionKey become crate-internal; the public crypto surface is CryptoService + CryptoConfig (renamed from MasterKeyConfig) + CryptoError.
• From<CryptoError> for the handler HTTP error so call sites use ? — removing the repeated map_err boilerplate.
• DI rewired (crypto replaces master_key in ServiceState), cli CryptoArgs, server test helper, and the four connection/context call sites updated. service/security/master_key.rs deleted.

Verification

Full workspace green: cargo check, clippy -D warnings, cargo +nightly fmt --check, cargo doc -D warnings, cargo deny check all, tests (incl. 4 new CryptoService tests). Server boots end-to-end and loads the key through CryptoService.

🤖 Generated with Claude Code