Add optional at-rest encryption for the snapshot library

## Motivation

`SECURITY.md` states plainly that snapshots are "not encrypted at rest beyond the OS (FileVault / device encryption)" and that "anyone with the user's unlocked account can read Application Support." Redaction is explicitly scoped to *sharing*, not to at-rest access control.

That is a defensible default, but it is a weak position for the product's own threat model. A Diffuse library is a longitudinal record of installed applications, developer tooling, network paths, and — where enabled — process names. On a shared Mac, any other admin account, any backup tool, and any process running as the user can read the entire history in plaintext JSON. Users who would most value device history are exactly the users who would want it encrypted.

## Proposed Solution

Add an opt-in encrypted store mode backed by CryptoKit on Apple platforms and Jetpack Security / the Android Keystore on Android. The symmetric key lives in the Keychain / Keystore, gated by device unlock and, where available, biometry. `FileSnapshotStore` gains an encrypting wrapper so the on-disk format becomes an envelope (`{ version, nonce, ciphertext }`) while the plaintext payload stays exactly the current schema-v1 JSON — no change to the diff engine, the fixtures, or the cross-language contract.

Enabling encryption migrates the existing library in place; disabling it decrypts back. Export continues to emit plaintext, redacted by classification as it does today.

## Acceptance Criteria

- [ ] Opt-in setting on all five apps, off by default, with an explicit warning that losing the key loses the library
- [ ] Key stored in Keychain / Android Keystore, never in the repository, never in a snapshot, never exported
- [ ] `FileSnapshotStore` transparently encrypts and decrypts; the diff engine and fixtures are untouched
- [ ] Enabling and disabling migrate the whole library atomically, with the newest snapshot never at risk
- [ ] Tests cover round-trip, wrong-key failure, and interrupted migration
- [ ] `SECURITY.md` and `Documentation/Privacy.md` are updated to describe the new posture accurately

## Additional Context

Must not introduce a third-party Swift package ([ADR 0004](Documentation/adr/0004-no-third-party-deps.md)) — CryptoKit is a system framework and is fine.