pub fn encrypt_dir_a256gcm( plaintext: &[u8], cek: &[u8; 32], kid: &str, ) -> Result<String, WebexError>
Encrypt plaintext using dir + A256GCM (direct encryption — key is CEK).