Add password-specific encryption API

[michaelmawhinney]

Parent: #19

Problem

The current $key parameter is overloaded as either passphrase or key material. Password-based encryption should have its own API and should use Argon2id with envelope-stored metadata.

Tasks

• Design encryptWithPassword() API
• Design decryptWithPassword() API
• Reject empty passwords
• Use Argon2id with generated salt
• Store salt and KDF parameters in the envelope
• Add documentation and tests