fix(security): use the configured security.encryption_key for wallet-at-rest encryption

[cypriannwokolo2-creator]

Summary

config.go:329,334 require and validate a 32-byte security.encryption_key, but it is never used. Instead wallet/service.go:505-526 encrypts the secret key with AES key = SHA256(passkeySeed) - the same secret that derives the wallet, so encryption adds nothing if the seed leaks.

Acceptance Criteria

• Encrypt wallet secret material with the configured encryption key (or a derived key from it)
• Do not derive the encryption key from the wallet seed itself
• Handle rotation and legacy-decryption path
• Crypto tests

Complexity

High - cryptography + migration of stored data.

[captainjoel2019-bit]

@captainjoel2019-bit has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello, I’ve reviewed the wallet encryption issue and understand the cryptographic and migration requirements. I’m confident I can use the configured encryption key safely, preserve legacy decryption for existing data, support key rotation, and add comprehensive crypto regression tests.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @captainjoel2019-bit to this issue.

[nasirudeenbadirudeen87-cloud]

@nasirudeenbadirudeen87-cloud has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi Maintainer,I have reviewed the issue in detail. Full stack background with solid experience relevant to this task. No blockers on my end — I'm ready to submit a PR shortly. Please assign.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @nasirudeenbadirudeen87-cloud to this issue.

[cypriannwokolo2-creator]

Already implemented: wallet model supports multiple decryption keys (configured ENCRYPTION_KEY + legacy passkey seed). DecryptSecret iterates all keys with fallback.