feat(store): encrypted filestore

[Benehiko]

This commit introduces an encrypted filestore backed by the os.Root type,
which enforces a flat storage structure confined to a specific directory.
Each secret is stored per encryption function in its own file, alongside a
public metadata file in JSON format. Filenames are base64-encoded secret
IDs to avoid issues with forward slashes ("/") and other special characters.

All secret files are encrypted with the filippo.io/age library, which
supports multiple encryption and decryption methods, including hardware
keys, SSH keys, and custom plugins. The store cannot follow symlinks
outside the directory specified by os.Root, ensuring stronger isolation.

[Copilot]

Pull Request Overview

This pull request implements an encrypted filestore for storing secrets on disk using filippo.io/age encryption. The implementation creates a new file-based storage backend that encrypts secret contents while keeping metadata unencrypted.

• Adds encrypted filestore package with encryption/decryption using filippo.io/age library
• Refactors Factory type to be shared across store implementations
• Updates Go version requirement to 1.25

Reviewed Changes

Copilot reviewed 5 out of 105 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
store/store.go	Adds shared Factory type definition for secret instantiation
store/keychain/keychain.go	Updates to use shared Factory type from store package
store/go.mod	Updates Go version to 1.25 and adds filippo.io/age dependency
store/filestore/filestore.go	New encrypted filestore implementation with core functionality
store/filestore/filestore_test.go	Comprehensive test suite for filestore operations

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[joe0BAB]

non-blocking (eg for follow up PR): some small test that verifies the combination of Persist/Restore works

(I know we implicitly cover this on the next layer above / in store_test.go, it's still helpful eg when troubleshooting/debugging to easily spot what works independently and what not)

[joe0BAB]

LGTM! (the missing unlock calls should be fixed before merging though)

(was already fixed, just didn't see as I was logged out..)

[Copilot]

Pull Request Overview

Copilot reviewed 12 out of 158 changed files in this pull request and generated 2 comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}