Function encryption_enabled 

pub fn encryption_enabled(config_flag: Option<bool>) -> bool

Consult the [encryption].at_rest config flag OR the AI_MEMORY_ENCRYPT_AT_REST=1 env var. Truthy env values: 1 / true / yes / on (case-insensitive). Used by the storage write path to gate the encrypt-on-insert / decrypt-on-read branches.

The config flag is consulted first when present, then the env var. Either truthy source enables encryption. This mirrors the precedence shape of the existing AI_MEMORY_PERMISSIONS_MODE config knob.