pub fn maybe_encrypt_text(plaintext: &str) -> Result<String, String>
Encrypt a text field for at-rest storage. Off → unchanged. Enabled but the vault is empty → Err.