v0.20.0: at-rest encryption (AES-256-GCM) for all query-derived text

- crypto.py: AES-256-GCM encrypt/decrypt + ensure_key()
- Key auto-generated on first boot, stored as heartbeat_interval_ms in settings
- All 12 storage paths wired (SQLite + Qdrant)
- memory.py: FTS5 search replaced with Python-side matching
- 200/200 tests pass

tests/test_upload.py

@@ -48,6 +48,7 @@ def test_upload_unsupported_mime(tmp_path: Path):
 
 
 def test_upload_context_mode(tmp_path: Path):
+    from crypto import decrypt_text
     with make_client(tmp_path) as client:
         resp = client.post(
             "/api/upload", headers=_admin_headers(client),
@@ -62,7 +63,7 @@ def test_upload_context_mode(tmp_path: Path):
         assert "chunks_ingested" not in data
 
         row = db.get_db().execute("SELECT content FROM upload_context WHERE id = ?", (data["context_id"],)).fetchone()
-        assert row["content"] == "Hello world notes"
+        assert decrypt_text(row["content"]) == "Hello world notes"
 
 
 def test_upload_ingest_mode(tmp_path: Path, monkeypatch):