v0.20.0: at-rest encryption (AES-256-GCM) for all query-derived text

- crypto.py: AES-256-GCM encrypt/decrypt + ensure_key()
- Key auto-generated on first boot, stored as heartbeat_interval_ms in settings
- All 12 storage paths wired (SQLite + Qdrant)
- memory.py: FTS5 search replaced with Python-side matching
- 200/200 tests pass

app.py

@@ -58,6 +58,8 @@ async def lifespan(app: FastAPI):
     log.info(f"cAIc {VERSION} starting up")
     os.makedirs(UPLOAD_DIR, exist_ok=True)
     init_db()
+    from crypto import ensure_key
+    ensure_key()
     log.info(f"Memory system: {get_memory_count()} memories loaded")
     await assess_hardware()
     from model_pull import ensure_model