refactor: deepen keyring seam, transit domain, and audit signing

[allisson]

Summary

Three architectural deepening refactors targeting modules identified as shallow in an internal review. Each commit is self-contained and passes the full test suite.

Commit 1 — Complete the Keyring seam (40098d8)

internal/keyring was introduced in #124 as a single module for envelope encryption, but callers were still importing internal/crypto/domain directly to access ErrDecryptionFailed, Zero, and Algorithm. This commit closes that gap:

• Re-exports ErrDecryptionFailed, Zero, ErrKekNotFound from keyring so callers need no crypto/domain import
• Maps ErrDekNotFound / ErrKekNotFound to ErrDecryptionFailed internally in Decrypt and openCipher — errors no longer leak across the seam
• Migrates all feature callers (secrets, transit, tokenization HTTP/usecase) off crypto/domain

Commit 2 — Move transit nonce framing into transit/domain (9ca5342)

The usecase held a hardcoded const nonceSize = 12 and manually sliced nonce ‖ ciphertext. This is domain knowledge (the AEAD wire format) living in the wrong layer:

• Adds AEADNonceSize = 12 to transit/domain constants
• Adds NewFramedBlob(version, nonce, ciphertext) and SplitNonce() to EncryptedBlob
• Removes the manual framing from the usecase; Encrypt and Decrypt become single-line domain calls
• Full test coverage for NewFramedBlob and SplitNonce

Commit 3 — Move audit signing behind a KeySigner seam (9b3b117)

auditLogUseCase held a *cryptoDomain.KekChain — raw key material passing through the usecase layer. The AuditSigner service also took kekKey []byte directly. This commit keeps key bytes inside keyring:

• Adds KeySigner interface to keyring: SignWithKey(data []byte) (sig, kekID) and VerifyWithKey(kekID, data, sig)
• Production keyring implements KeySigner via HKDF-SHA256 + HMAC-SHA256 (same algorithm, now encapsulated)
• Canonicalization logic moves from auth/service.auditSigner to auth/domain.AuditLog.Canonical() — the domain type owns its wire format
• auditLogUseCase drops kekChain and auditSigner; constructor is now NewAuditLogUseCase(repo, keySigner)
• keyring.Fake implements KeySigner with a deterministic zero-key HMAC, making it a real second adapter

Test plan

• go test ./... — 1541 tests pass, no failures
• Each commit builds and tests independently
• keyring.Fake satisfies the new KeySigner interface, keeping feature tests decoupled from the database

🤖 Generated with Claude Code