Versioned AES-256-GCM codec for provider credentials.
Options must contain :active_key_id and a :keys map. Each key is a
Base64-encoded 32-byte value or an explicit {:raw, value} tuple. Encryption
always uses the active key. Decryption selects the key ID from the ciphertext,
so old keys can stay in the map during rotation.
Set :allow_plaintext to false after an explicit migration is verified.