pub fn encryption_key() -> Option<String>
Load optional encryption key from XDG config only (never product env vars).