pub fn init_key(secret_key_b64: Option<&str>) -> Result<()>Expand description
Decode + validate HELDAR_SECRET_KEY (base64 of 32 bytes) and install it process-wide. Call once
at startup. None/empty disables encryption (plaintext at rest). Errors on a malformed key so a
misconfigured master key fails loud at boot rather than silently disabling encryption.