AES-256-GCM authenticated encryption for kura's at-rest field encryption ({encrypted, InnerType} fields).

A ciphertext is a self-framed binary:

<<Version:8, KeyId:8, Nonce:12/binary, Tag:16/binary, CipherText/binary>>

Version and KeyId are authenticated as additional data (AAD), so they cannot be flipped without failing the tag check. Each value gets a fresh random 96-bit nonce. Keys come from a kura_keyring (default kura_keyring_env); KeyId is embedded so decryption is an O(1) key lookup, never a trial-decrypt.

Every failure raises error({kura_crypto, Reason}) - it never returns a value or an {error, _} tuple. This is deliberate: the dump/load seams fall open (substitute the raw value on {error, _}), so a raise is the only way to guarantee a crypto failure never writes plaintext to an encrypted column or returns ciphertext as if it were the value. Reason carries only atoms and the (non-secret) KeyId - never key material, plaintext, or ciphertext, which would leak into crash reports and logs.