[codex] test(cryptox): cover AES-256-GCM helpers

[prettyboyvic]

Summary

• add comprehensive tests for AES-256-GCM key parsing, round trips, empty and large plaintexts, nonce randomness, tamper detection, wrong keys, and short ciphertexts
• inject the nonce reader through a private helper so the random-source failure path is testable without mutable package state
• centralize GCM construction while preserving error handling and the existing nonce || ciphertext format
• add package documentation for the at-rest encryption helpers

Security notes

• tests use synthetic keys only; no production credentials are embedded
• authenticated decryption rejects modified ciphertext and incorrect keys
• repeated plaintext encryption produces different blobs while both decrypt correctly
• the encrypted blob format and public API remain unchanged

Validation

• go test -coverprofile=<temp> ./internal/cryptox/... — passed
• go tool cover -func=<temp> — 100.0% statement coverage
• go test ./internal/cryptox/... -race — unavailable locally because Windows cgo requires gcc, which is not installed
• git diff --check — passed

Closes #38