pub fn encrypt(plaintext: &str, key: &[u8]) -> Result<String>
Encrypts a plaintext string using AES-256-GCM and a 32-byte key.
Returns a hex-encoded string containing the nonce followed by the ciphertext.