Implement PlaintextPolicy and Encryption Detection

[pvandervelde]

Context

• Specification: docs/spec/modules/cryptography.md sections 3.4, 5.2
• Location: src/crypto/policy.rs, src/client.rs integration
• Purpose: Control handling of unencrypted messages in production
• Detection: Check for "QRE1" magic marker at message start
• Assertions: docs/spec/assertions.md test(quality): add contract, integration, property, fuzz, and security tests #35, chore(deps): bump openssl from 0.10.77 to 0.10.78 #36, chore(deps): bump rustls-webpki from 0.103.12 to 0.103.13 #37

Subtasks

• 22.1 Implement PlaintextPolicy enum (Allow, Reject, AllowWithAlert)
• 22.2 Implement is_encrypted(data: &[u8]) detection function (checks MAGIC_MARKER)
• 22.3 Implement policy enforcement in message receive path
• 22.4 Add structured logging for plaintext message detection (WARNING level)
• 22.5 Add metrics labels (encrypted=true|false) to send/receive operations
• 22.6 Add unit tests for encryption detection (Assertion test(quality): add contract, integration, property, fuzz, and security tests #35)
• 22.7 Add integration test for policy enforcement (Assertion chore(deps): bump rustls-webpki from 0.103.12 to 0.103.13 #37)

Phase

Phase 5: Cryptography Module Implementation (Task 22.0)