feat(security): harden local backup encryption

Write new backups as MDD2 envelopes with per-file scrypt salts, random IVs, and AES-256-GCM authenticated encryption. Authenticate the versioned header and normalize malformed or tampered payload failures without exposing protected data.

Keep MDD1 decryption as read-only migration compatibility and add regression coverage for known legacy imports, truncation, unsupported versions, nondeterministic output, and tampering across every protected envelope field.

tests/backup-crypto.test.ts

@@ -5,7 +5,7 @@ describe("backup-crypto", () => {
   it("encrypts and decrypts a round-trip correctly", () => {
     const original = JSON.stringify({
       version: 2,
-      settings: { token: "my-secret-api-key", outputDir: "C:\\Downloads" },
+      settings: { outputDir: "C:\\Downloads" },
       session: { packages: {}, items: {} },
       history: [{ id: "h1", name: "Test" }]
     });
@@ -16,39 +16,62 @@ describe("backup-crypto", () => {
   });
 
   it("produces binary output that is not plaintext readable", () => {
-    const secret = "super-secret-token-12345";
-    const plaintext = JSON.stringify({ settings: { token: secret } });
+    const sensitiveValue = "value-that-must-not-be-readable";
+    const plaintext = JSON.stringify({ settings: { value: sensitiveValue } });
     const encrypted = encryptBackup(plaintext);
 
-    expect(encrypted.toString("utf8")).not.toContain(secret);
-    expect(encrypted.toString("latin1")).not.toContain(secret);
+    expect(encrypted.toString("utf8")).not.toContain(sensitiveValue);
+    expect(encrypted.toString("latin1")).not.toContain(sensitiveValue);
   });
 
-  it("starts with the MDD1 magic bytes", () => {
+  it("writes the MDD2 backup format", () => {
     const encrypted = encryptBackup("test");
-    expect(encrypted.subarray(0, 4).toString("utf8")).toBe("MDD1");
+    expect(encrypted.subarray(0, 4).toString("utf8")).toBe("MDD2");
+    expect(encrypted.length).toBeGreaterThan(48);
   });
 
-  it("produces different ciphertext for the same input (random IV)", () => {
+  it("reads the legacy backup format for migration", () => {
+    const legacy = Buffer.from("TUREMQcHBwcHBwcHBwcHB7h4ood1DE8Wc+BPgzE6EYdio3HAN/UB1Mru6Fmvtw==", "base64");
+    expect(decryptBackup(legacy)).toBe("legacy payload");
+  });
+
+  it("uses a new salt and IV for every encryption", () => {
     const plaintext = "same input data";
     const a = encryptBackup(plaintext);
     const b = encryptBackup(plaintext);
     expect(a.equals(b)).toBe(false);
+    expect(a.subarray(4, 20).equals(b.subarray(4, 20))).toBe(false);
+    expect(a.subarray(20, 32).equals(b.subarray(20, 32))).toBe(false);
     expect(decryptBackup(a)).toBe(plaintext);
     expect(decryptBackup(b)).toBe(plaintext);
   });
 
   it("throws on truncated data", () => {
     const encrypted = encryptBackup("test data");
-    const truncated = encrypted.subarray(0, 10);
-    expect(() => decryptBackup(truncated)).toThrow();
+    expect(() => decryptBackup(encrypted.subarray(0, 47))).toThrow(/zu kurz|ungültig/);
   });
 
-  it("throws on corrupted ciphertext", () => {
+  it.each([
+    ["salt", 4],
+    ["IV", 20],
+    ["authentication tag", 32],
+    ["ciphertext", 48]
+  ])("rejects a modified %s", (_part, offset) => {
     const encrypted = encryptBackup("test data");
     const corrupted = Buffer.from(encrypted);
-    corrupted[corrupted.length - 1] ^= 0xff;
-    expect(() => decryptBackup(corrupted)).toThrow();
+    corrupted[offset] ^= 0xff;
+    expect(() => decryptBackup(corrupted)).toThrow(/beschädigt|authentifiziert/);
+  });
+
+  it("rejects modified legacy authentication data", () => {
+    const legacy = Buffer.from("TUREMQcHBwcHBwcHBwcHB7h4ood1DE8Wc+BPgzE6EYdio3HAN/UB1Mru6Fmvtw==", "base64");
+    legacy[16] ^= 0xff;
+    expect(() => decryptBackup(legacy)).toThrow(/beschädigt|authentifiziert/);
+  });
+
+  it("rejects unsupported backup versions", () => {
+    const unsupported = Buffer.concat([Buffer.from("MDD3"), Buffer.alloc(44)]);
+    expect(() => decryptBackup(unsupported)).toThrow(/Version/);
   });
 
   it("throws on wrong magic bytes", () => {