Add configuration options for encryption

**Description**
Currently core lacks proper encryption support.

**Proposed solution**
Add configurable encryption with sensible defaults.

**Priority**: Low/Medium

No files, tests, or entry points are named. Start by locating the core configuration path and existing security-related behavior, then clarify which data must be encrypted and how options and defaults should work. Done requires an agreed configuration design, sensible defaults, and coverage for the supported encryption behavior.

Written by the indexing model from the issue text.