Implement secure AES-CBC encryption with external C++ decryption

- Replace weak ECB encryption with AES-128-CBC + PKCS7 padding
- Implement secure key derivation: SHA256(password + salt)
- Add cryptographically secure random IV generation
- Create standalone C++ decryptor for external binary decryption
- Update stub to require external decryption workflow
- Maintain cross-platform compatibility (Linux/Windows)
- Add proper error handling and padding validation

Security improvements:
- AES-128-CBC instead of ECB (prevents pattern analysis)
- Random IVs prevent identical plaintext producing identical ciphertext
- Password-based key derivation with salt
- PKCS7 padding with validation
- External decryption prevents embedded keys

crypt/Cargo.toml

@@ -6,7 +6,9 @@ edition = "2021"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-block-modes = "0.7.0"
+aes-gcm = "0.10.3"
 rand = "0.8.4"
 aes = "0.8.2"
 crypto = "0.4.0"
+sha2 = "0.10.8"
+argon2 = "0.5.2"