pub fn maybe_encrypt_blob(plaintext: &[u8]) -> Result<Vec<u8>, String>
Encrypt a secret key BLOB for at-rest storage. Off → unchanged. Enabled but the vault is empty → Err (never silently persists a secret in plaintext).