feat(05-03): implement lagoon.Encrypted, key:generate, Laravel decrypt helper

- AES-256-GCM with stdlib HKDF column keys and previous_keys fallback
- Fail-loud LoadAppKey, redacting marshal paths, key:generate via crypto/rand
- Standalone DecryptLaravelPayload unwired from Scan/Value

lagoon/commands.go

@@ -11,7 +11,7 @@ import (
 	"gorm.io/gorm"
 )
 
-// RuntimeCommands returns migrate, migrate:rollback and migrate:status.
+// RuntimeCommands returns migrate, migrate:rollback, migrate:status, and key:generate.
 // Serve is registered separately via surf.ServeCommand.
 func RuntimeCommands(app *backpack.App, plugins []party.Plugin) []bonfire.Command {
 	return []bonfire.Command{
@@ -71,6 +71,7 @@ func RuntimeCommands(app *backpack.App, plugins []party.Plugin) []bonfire.Comman
 				})
 			},
 		},
+		KeyGenerateCommand(),
 	}
 }