pub fn encrypt_notes( plaintext: &[u8], password: &str, ) -> Result<Vec<u8>, String>
Encrypt NDJSON note bytes using AES-256-GCM and PBKDF2 key derivation.