feat(05-03): implement lagoon.Encrypted, key:generate, Laravel decrypt helper

- AES-256-GCM with stdlib HKDF column keys and previous_keys fallback
- Fail-loud LoadAppKey, redacting marshal paths, key:generate via crypto/rand
- Standalone DecryptLaravelPayload unwired from Scan/Value

lagoon/encrypted_test.go

@@ -78,7 +78,7 @@ func TestEncryptedRedacts(t *testing.T) {
 	}
 	goRepr := fmt.Sprintf("%#v", e)
 	if strings.Contains(goRepr, secret) {
-		t.Fatalf("GoString/%#v leaked plaintext: %q", goRepr)
+		t.Fatalf("GoString/%%#v leaked plaintext: %q", goRepr)
 	}
 }