pub fn key_derivation_error(msg: impl Into<String>) -> AppError
Helper to create a service-specific error for key derivation failures.