refactor: move crypto logic into go.getarcane.app/sys/crypto

[kmendell]

Checklist

• This PR is not opened from my fork’s main branch
• All new user-facing strings are translated via Paraglide (m.*())

What This PR Implements

Fixes:

Changes Made

Testing Done

AI Tool Used (if applicable)

Additional Context

Disclaimer Greptiles Reviews use AI, make sure to check over its work.

To better help train Greptile on our codebase, if the comment is useful and valid Like the comment, if its not helpful or invalid Dislike

To have Greptile Re-Review the changes, mention greptileai.

Greptile Summary

This PR moves backend encryption logic to go.getarcane.app/sys/crypto. The main changes are:

• Replaces local pkg/libarcane/crypto imports with the shared sys crypto module.
• Removes the old local crypto implementation and tests.
• Adds a bootstrap guard for short production ENCRYPTION_KEY passphrases.
• Updates affected backend services, handlers, edge TLS code, and tests.

Confidence Score: 5/5

This PR appears safe to merge with low risk.

The changes are mostly import rewrites plus removal of the migrated local crypto implementation. The previously reported weak production key regression has been addressed by the new bootstrap guard, and no remaining correctness or security issues were identified in the changed paths.

No files require special attention.

T-Rex Logs

What T-Rex did

• The general contract validation proof confirms that a log of the crypto refactor Go tests was saved with full verbose output, including the command, working directory, exit code, package summaries, and failure details.
• The log shows two failing service tests: TestProjectService_UpdateProject_AllowsRenameAfterJournalRecoveryDockerUnavailable and TestProjectService_ListProjects_WithDerivedStatusFilter_AllowsAllPageSizeSentinel.
• Runtime hints indicate Docker is unavailable at runtime, and the observed failures are outside the crypto credential changes, so they are not reported as crypto refactor regressions.

_{Ran code and verified through T-Rex}

_{Reviews (2): Last reviewed commit: "refactor: move crypto logic into go.geta..." | Re-trigger Greptile}

[kmendell]

• refactor: move crypto logic into go.getarcane.app/sys/crypto #3164 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[getarcaneappbot]

Container images for this PR have been built successfully!

• Manager: ghcr.io/getarcaneapp/manager:pr-3164
• Agent: ghcr.io/getarcaneapp/agent:pr-3164

Built from commit 955ab2a

[graphite-app]

Graphite Automations

"Warn authors when publishing large PRs" took an action on this PR • (07/04/26)

1 teammate was notified to this PR based on Kyle Mendell's automation.

[github-actions]

This pull request has merge conflicts. Please resolve the conflicts so the PR can stay up-to-date and reviewed.